Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Document.doc.scr.exe

Overview

General Information

Sample name:Document.doc.scr.exe
Analysis ID:1432010
MD5:407ea767aa26ae13f9ff20d0999c8dda
SHA1:07e615132ef78e827047ffc4cc6c9d44f5a976fd
SHA256:f2198deecddd5ae56620b594b6b20bf8a20f9c983d4c60144bc6007a53087ce4
Tags:BlackMatterexescr
Infos:

Detection

LockBit ransomware, TrojanRansom
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Found ransom note / readme
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Yara detected LockBit ransomware
Yara detected TrojanRansom
Changes the wallpaper picture
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Deletes itself after installation
Found Tor onion address
Found potential ransomware demand text
Hides threads from debuggers
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Modifies existing user documents (likely ransomware behavior)
Overwrites Mozilla Firefox settings
Sample has a suspicious name (potential lure to open the executable)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Uses an obfuscated file name to hide its real file extension (double extension)
Writes many files with high entropy
Writes to foreign memory regions
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to clear windows event logs (to hide its activities)
Contains functionality to communicate with device drivers
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Enables debug privileges
Enables security privileges
PE file contains an invalid checksum
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Potentially Suspicious Desktop Background Change Via Registry
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • Document.doc.scr.exe (PID: 5320 cmdline: "C:\Users\user\Desktop\Document.doc.scr.exe" MD5: 407EA767AA26AE13F9FF20D0999C8DDA)
    • splwow64.exe (PID: 2696 cmdline: C:\Windows\splwow64.exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)
    • D448.tmp (PID: 1028 cmdline: "C:\ProgramData\D448.tmp" MD5: 294E9F64CB1642DD89229FFF0592856B)
      • cmd.exe (PID: 932 cmdline: "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D448.tmp >> NUL MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • conhost.exe (PID: 4828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • ONENOTE.EXE (PID: 3748 cmdline: /insertdoc "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\{E6830A1B-81EB-4C98-A5C6-BA0FB0C332A2}.xps" 133585893886890000 MD5: 0061760D72416BCF5F2D9FA6564F0BEA)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
Document.doc.scr.exeJoeSecurity_LockBit_ransomwareYara detected LockBit ransomwareJoe Security
    Document.doc.scr.exeWindows_Ransomware_Lockbit_369e1e94unknownunknown
    • 0x1861d:$a2: 8B EC 53 56 57 33 C0 8B 5D 14 33 C9 33 D2 8B 75 0C 8B 7D 08 85 F6 74 33 55 8B 6D 10 8A 54 0D 00 02 D3 8A 5C 15 00 8A 54 1D 00
    • 0x4bc:$a3: 53 51 6A 01 58 0F A2 F7 C1 00 00 00 40 0F 95 C0 84 C0 74 09 0F C7 F0 0F C7 F2 59 5B C3 6A 07 58 33 C9 0F A2 F7 C3 00 00 04 00 0F 95 C0 84 C0 74 09 0F C7 F8 0F C7 FA 59 5B C3 0F 31 8B C8 C1 C9 ...

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmpJoeSecurity_LockBit_ransomwareYara detected LockBit ransomwareJoe Security
      00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmpWindows_Ransomware_Lockbit_369e1e94unknownunknown
      • 0x1841d:$a2: 8B EC 53 56 57 33 C0 8B 5D 14 33 C9 33 D2 8B 75 0C 8B 7D 08 85 F6 74 33 55 8B 6D 10 8A 54 0D 00 02 D3 8A 5C 15 00 8A 54 1D 00
      • 0xbc:$a3: 53 51 6A 01 58 0F A2 F7 C1 00 00 00 40 0F 95 C0 84 C0 74 09 0F C7 F0 0F C7 F2 59 5B C3 6A 07 58 33 C9 0F A2 F7 C3 00 00 04 00 0F 95 C0 84 C0 74 09 0F C7 F8 0F C7 FA 59 5B C3 0F 31 8B C8 C1 C9 ...
      00000000.00000003.2091177762.00000000013F1000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_LockBit_ransomwareYara detected LockBit ransomwareJoe Security
        00000000.00000000.1618448431.0000000000BE1000.00000020.00000001.01000000.00000003.sdmpJoeSecurity_LockBit_ransomwareYara detected LockBit ransomwareJoe Security
          00000000.00000000.1618448431.0000000000BE1000.00000020.00000001.01000000.00000003.sdmpWindows_Ransomware_Lockbit_369e1e94unknownunknown
          • 0x1841d:$a2: 8B EC 53 56 57 33 C0 8B 5D 14 33 C9 33 D2 8B 75 0C 8B 7D 08 85 F6 74 33 55 8B 6D 10 8A 54 0D 00 02 D3 8A 5C 15 00 8A 54 1D 00
          • 0xbc:$a3: 53 51 6A 01 58 0F A2 F7 C1 00 00 00 40 0F 95 C0 84 C0 74 09 0F C7 F0 0F C7 F2 59 5B C3 6A 07 58 33 C9 0F A2 F7 C3 00 00 04 00 0F 95 C0 84 C0 74 09 0F C7 F8 0F C7 FA 59 5B C3 0F 31 8B C8 C1 C9 ...
          Click to see the 3 entries

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          0.0.Document.doc.scr.exe.be0000.0.unpackJoeSecurity_LockBit_ransomwareYara detected LockBit ransomwareJoe Security
            0.0.Document.doc.scr.exe.be0000.0.unpackWindows_Ransomware_Lockbit_369e1e94unknownunknown
            • 0x1861d:$a2: 8B EC 53 56 57 33 C0 8B 5D 14 33 C9 33 D2 8B 75 0C 8B 7D 08 85 F6 74 33 55 8B 6D 10 8A 54 0D 00 02 D3 8A 5C 15 00 8A 54 1D 00
            • 0x4bc:$a3: 53 51 6A 01 58 0F A2 F7 C1 00 00 00 40 0F 95 C0 84 C0 74 09 0F C7 F0 0F C7 F2 59 5B C3 6A 07 58 33 C9 0F A2 F7 C3 00 00 04 00 0F 95 C0 84 C0 74 09 0F C7 F8 0F C7 FA 59 5B C3 0F 31 8B C8 C1 C9 ...
            0.2.Document.doc.scr.exe.be0000.0.unpackJoeSecurity_LockBit_ransomwareYara detected LockBit ransomwareJoe Security
              0.2.Document.doc.scr.exe.be0000.0.unpackWindows_Ransomware_Lockbit_369e1e94unknownunknown
              • 0x1861d:$a2: 8B EC 53 56 57 33 C0 8B 5D 14 33 C9 33 D2 8B 75 0C 8B 7D 08 85 F6 74 33 55 8B 6D 10 8A 54 0D 00 02 D3 8A 5C 15 00 8A 54 1D 00
              • 0x4bc:$a3: 53 51 6A 01 58 0F A2 F7 C1 00 00 00 40 0F 95 C0 84 C0 74 09 0F C7 F0 0F C7 F2 59 5B C3 6A 07 58 33 C9 0F A2 F7 C3 00 00 04 00 0F 95 C0 84 C0 74 09 0F C7 F8 0F C7 FA 59 5B C3 0F 31 8B C8 C1 C9 ...

              Sigma Signatures

              System Summary

              barindex
              Sigma detected: Potentially Suspicious Desktop Background Change Via Registry
              Source: Registry Key setAuthor: Nasreddine Bencherchali (Nextron Systems), Stephen Lincoln @slincoln-aiq (AttackIQ): Data: Details: C:\ProgramData\jC7CNxlVt.bmp, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Document.doc.scr.exe, ProcessId: 5320, TargetObject: HKEY_CURRENT_USER\Control Panel\Desktop\WallPaper

              Snort Signatures

              ⊘No Snort rule has matched

              Joe Sandbox Signatures

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Antivirus / Scanner detection for submitted sample
              Source: Document.doc.scr.exeAvira: detected
              Antivirus detection for URL or domain
              Source: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionAvira URL Cloud: Label: malware
              Multi AV Scanner detection for domain / URL
              Source: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionVirustotal: Detection: 12%Perma Link
              Multi AV Scanner detection for submitted file
              Source: Document.doc.scr.exeReversingLabs: Detection: 86%
              Source: Document.doc.scr.exeVirustotal: Detection: 86%Perma Link
              Machine Learning detection for sample
              Source: Document.doc.scr.exeJoe Sandbox ML: detected
              Source: Document.doc.scr.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Videos\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Searches\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Saved Games\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Recent\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Pictures\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Pictures\Saved Pictures\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Pictures\Camera Roll\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\OneDrive\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Music\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Links\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Favorites\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Favorites\Links\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Downloads\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Documents\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Documents\ZQIXMVQGAH\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Documents\ZBEDCJPBEY\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Documents\XZXHAVGRAG\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Documents\VAMYDFPUND\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Documents\SFPUSAFIOL\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Documents\ONBQCLYSPU\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Documents\KZWFNRXYKI\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Documents\KATAXZVCPS\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Documents\HTAGVDFUIE\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Documents\DTBZGIOOSO\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Documents\CURQNKVOIX\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Documents\AIXACVYBSB\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Desktop\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Desktop\ZQIXMVQGAH\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Desktop\ZBEDCJPBEY\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Desktop\XZXHAVGRAG\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Desktop\VAMYDFPUND\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Desktop\SFPUSAFIOL\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Desktop\ONBQCLYSPU\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Desktop\KZWFNRXYKI\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Desktop\KATAXZVCPS\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Desktop\HTAGVDFUIE\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Desktop\DTBZGIOOSO\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Desktop\CURQNKVOIX\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Desktop\AIXACVYBSB\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Contacts\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Skype\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Skype\RootTools\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\to-be-removed\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\temporary\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\security_state\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\minidumps\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\tmp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\events\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\bookmarkbackups\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending Pings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Extensions\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\f2eb6c79-671d-4de2-b7be-3b2eea7abc47\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\6d9d9777-7ded-4768-8191-9a707d72b009\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\61f56613-c62c-4b17-84dd-62b60d5776aa\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\56079431-ea46-4833-94f9-1ff5658cdb1c\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Sonar\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Sonar\SonarCC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\RTTransfer\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\LogTransport2CC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\LogTransport2\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Linguistics\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Headlights\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Flash Player\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Flash Player\NativeCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\CRLogs\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\CRLogs\crashlogs\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\Preflight Acrobat Continuous\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Forms\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Collab\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Linguistics\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cookie\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\VideoDecodeStats\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\d1702bdf-c0c8-42c3-b6d9-e52fd0a57b16\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\assets\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\DesktopNotification\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\DesktopNotification\NotificationsDB\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\VirtualStore\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\Symbols\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\mozilla-temp-files\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\Low\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\Diagnostics\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\SearchEmbdIndex\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\acrocef_low\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\DC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\SolidDocuments\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\SolidDocuments\Acrobat\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Publishers\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\SettingsContainer\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Microsoft.WindowsAlarms\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Licenses\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Fonts\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\PeerDistRepub\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\DiagOutputDir\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\BackgroundTransferApi\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\Flighting\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c58f7468-b990-418e-a4ba-ca3568b01c70}\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txtJump to behavior
              Source: Document.doc.scr.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
              Source: Binary string: ice\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\C7CNxlVt.README.txt source: Document.doc.scr.exe, 00000000.00000003.1682283519.00000000014FE000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2_0 source: Document.doc.scr.exe, 00000000.00000003.1682283519.00000000014FE000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\j source: Document.doc.scr.exe, 00000000.00000003.1682283519.00000000014FE000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\* source: Document.doc.scr.exe, 00000000.00000003.1682283519.00000000014FE000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.jC7CNxlVt source: Document.doc.scr.exe, 00000000.00000003.1705221595.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1711836076.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1718849776.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1717159713.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1718983651.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1703476299.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1710511244.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1712643035.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1686082464.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1713658697.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1715185404.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1695151935.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1719812875.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1711697152.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1699369432.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1694880017.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1680648061.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1712214810.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1720140260.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1693739427.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1719287121.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1714611951.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1701452290.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1702773878.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1714096402.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1705906875.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.d
              Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: Document.doc.scr.exe, 00000000.00000003.1939184092.00000000013CF000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013AE000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: WINLOA~1.PDBwinload_prod.pdb source: Document.doc.scr.exe, 00000000.00000003.1679982073.0000000001426000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2p source: Document.doc.scr.exe, 00000000.00000003.1682283519.00000000014FE000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: mi_exe_stub.pdb source: Document.doc.scr.exe, 00000000.00000003.1678909255.0000000001487000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1678737768.0000000001474000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\jC7CNxlVt.README.txt source: Document.doc.scr.exe, 00000000.00000003.1680648061.000000000143D000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: WINLOA~1.PDBntkrnlmp.pdb.pdb source: Document.doc.scr.exe, 00000000.00000003.1680648061.0000000001426000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.jC7CNxlVte source: Document.doc.scr.exe, 00000000.00000003.1680648061.000000000143D000.00000004.00000020.00020000.00000000.sdmp
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BE74BC FindFirstFileExW,FindNextFileW,0_2_00BE74BC
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BEA094 FindFirstFileExW,FindClose,0_2_00BEA094
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BE5C24 FindFirstFileW,FindClose,FindNextFileW,FindClose,0_2_00BE5C24
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BE7590 FindFirstFileExW,0_2_00BE7590
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BE766C FindFirstFileExW,GetFileAttributesW,FindNextFileW,0_2_00BE766C
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BEF308 GetFileAttributesW,SetThreadPriority,FindFirstFileExW,FindNextFileW,FindClose,0_2_00BEF308
              Source: C:\ProgramData\D448.tmpCode function: 9_2_0040227C FindFirstFileExW,9_2_0040227C
              Source: C:\ProgramData\D448.tmpCode function: 9_2_0040152C FindFirstFileExW,FindClose,FindNextFileW,FindClose,9_2_0040152C
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BEA470 GetLogicalDriveStringsW,0_2_00BEA470
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\Jump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Local\Temp\Diagnostics\Jump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Jump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Jump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\Jump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\Jump to behavior

              Networking

              barindex
              Found Tor onion address
              Source: Document.doc.scr.exe, 00000000.00000003.2091177762.00000000013F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
              Source: Document.doc.scr.exe, 00000000.00000003.2091177762.00000000013F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
              Source: Document.doc.scr.exe, 00000000.00000003.2091177762.00000000013F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionn
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionug
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionl
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionJK
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion]YK
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion]lK<<
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionsK/<
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionc
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionl
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionl
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion.Jr=
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion=Jm=
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion@J
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionlWJ
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion[
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
              Source: Document.doc.scr.exe, 00000000.00000003.1676814100.00000000014FE000.00000004.00000020.00020000.00000000.sdmp, 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
              Source: Document.doc.scr.exe, 00000000.00000003.1878035842.0000000001522000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://kinto.readthedocs.io/en/latest/tutorials/synchronisation.html#polling-for-remote-changes
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt.uz
              Source: Document.doc.scr.exe, 00000000.00000003.2091177762.00000000013F1000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion=Jm=
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionl
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionl
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionsK/
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionug
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion.Jr=
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionJK
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionc
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionl
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionlWJ
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionn
              Source: Document.doc.scr.exe, 00000000.00000003.2091177762.00000000013F1000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupp.uz
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: http://weather.service.msn.com/data.aspx
              Source: Document.doc.scr.exe, 00000000.00000003.1646091627.00000000014D5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://MD8.mozilla.org/1/m
              Source: 3870112724rsegmnoittet-es.sqlite.jC7CNxlVt.0.drString found in binary or memory: https://account.bellmedia.c
              Source: Document.doc.scr.exe, 00000000.00000003.1877029171.0000000001526000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.bellmedia.ca
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://addinsinstallation.store.office.com/app/download
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://addinslicensing.store.office.com/apps/remove
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://addinslicensing.store.office.com/commerce/query
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
              Source: Document.doc.scr.exe, 00000000.00000003.1645091771.00000000014D5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://allegro.pl/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://analysis.windows.net/powerbi/api
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://api.aadrm.com
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://api.aadrm.com/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://api.addins.omex.office.net/api/addins/search
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://api.addins.omex.office.net/appinfo/query
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://api.addins.omex.office.net/appstate/query
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://api.addins.store.office.com/addinstemplate
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://api.addins.store.office.com/app/query
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://api.cortana.ai
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://api.diagnostics.office.com
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://api.diagnosticssdf.office.com
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://api.microsoftstream.com
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://api.microsoftstream.com/api/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://api.office.net
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://api.onedrive.com
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/imports
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://api.scheduler.
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://apis.live.net/v5.0/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://apis.mobile.m365.svc.cloud.microsoft
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://arc.msn.com/v4/api/selection
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://augloop.office.com
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://augloop.office.com/v2
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://autodiscover-s.outlook.com/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
              Source: Document.doc.scr.exe, 00000000.00000003.1641926636.00000000014C2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
              Source: Document.doc.scr.exe, 00000000.00000003.1641926636.00000000014C2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
              Source: Document.doc.scr.exe, 00000000.00000003.1645091771.00000000014D5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mo
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://cdn.designerapp.osi.office.net/designer-mobile
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://cdn.entity.
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://cdn.hubblecontent.osi.office.net/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://clients.config.office.net
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://clients.config.office.net/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://clients.config.office.net/c2r/v1.0/DeltaAdvisory
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://config.edge.skype.com
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
              Source: Document.doc.scr.exe, 00000000.00000003.1877029171.0000000001526000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
              Source: Document.doc.scr.exe, 00000000.00000003.1641926636.00000000014C2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
              Source: Document.doc.scr.exe, 00000000.00000003.1641926636.00000000014C2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://cortana.ai
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://cortana.ai/api
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://cr.office.com
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://d.docs.live.net
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://dataservice.o365filtering.com
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://dataservice.o365filtering.com/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://designerapp.officeapps.live.com/designerapp
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://dev.cortana.ai
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://devnull.onenote.com
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://directory.services.
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://ecs.office.com
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://ecs.office.com/config/v1/Designer
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://ecs.office.com/config/v2/Office
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://edge.skype.com/registrar/prod
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://edge.skype.com/rps
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://enrichment.osi.office.net/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/v2.1601652342626
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://entitlement.diagnostics.office.com
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
              Source: Document.doc.scr.exe, 00000000.00000003.1878035842.0000000001522000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/
              Source: Document.doc.scr.exe, 00000000.00000003.1878035842.0000000001522000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://firefox.settings.services.mozilla.com/v1/
              Source: Document.doc.scr.exe, 00000000.00000003.1877029171.0000000001526000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/partitioning-exempt-urls/c
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://fpastorage.cdn.office.net/%s
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://fpastorage.cdn.office.net/firstpartyapp/addins.xml
              Source: Document.doc.scr.exe, 00000000.00000003.1878035842.0000000001522000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Kinto/kinto-attachment/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://globaldisco.crm.dynamics.com
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://graph.ppe.windows.net
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://graph.ppe.windows.net/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://graph.windows.net
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://graph.windows.net/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://ic3.teams.office.com
              Source: Document.doc.scr.exe, 00000000.00000003.1641926636.00000000014C2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://incidents.diagnostics.office.com
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://inclient.store.office.com/gyro/client
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://inclient.store.office.com/gyro/clientstore
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&amp;adlt=strict&amp;hostType=Immersive
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://invites.office.com/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://lifecycle.office.com
              Source: Document.doc.scr.exe, 00000000.00000003.1877029171.0000000001526000.00000004.00000020.00020000.00000000.sdmp, 3870112724rsegmnoittet-es.sqlite.jC7CNxlVt.0.drString found in binary or memory: https://login.live.com
              Source: Document.doc.scr.exe, 00000000.00000003.1877029171.0000000001526000.00000004.00000020.00020000.00000000.sdmp, 3870112724rsegmnoittet-es.sqlite.jC7CNxlVt.0.dr, 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://login.microsoftonline.com
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://login.microsoftonline.com/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://login.windows.local
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://make.powerautomate.com
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://management.azure.com
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://management.azure.com/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://messagebroker.mobile.m365.svc.cloud.microsoft
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://messaging.action.office.com/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://messaging.action.office.com/setcampaignaction
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://messaging.action.office.com/setuseraction16
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://messaging.engagement.office.com/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://messaging.lifecycle.office.com/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://messaging.office.com/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://metadata.templates.cdn.office.net/client/log
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://my.microsoftpersonalcontent.com
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://ncus.contentsync.
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://ncus.pagecontentsync.
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://officeapps.live.com
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://officeci.azurewebsites.net/api/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://officepyservice.office.net/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://officepyservice.office.net/service.functionality
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://onedrive.live.com
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://onedrive.live.com/embed?
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://otelrules.azureedge.net
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://otelrules.svc.static.microsoft
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://outlook.office.com
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://outlook.office.com/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://outlook.office365.com
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://outlook.office365.com/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://outlook.office365.com/connectors
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://pages.store.office.com/review/query
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://powerlift.acompli.net
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://pushchannel.1drv.ms
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
              Source: Document.doc.scr.exe, 00000000.00000003.1878035842.0000000001522000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://remote-settings.readthedocs.io
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://res.cdn.office.net
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://res.cdn.office.net/mro1cdnstorage/fonts/prod/4.39
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://res.cdn.office.net/polymer/models
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://safelinks.protection.outlook.com/api/GetPolicy
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://service.officepy.microsoftusercontent.com/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://settings.outlook.com
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://shell.suite.office.com:1443
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://skyapi.live.net/Activity/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://staging.cortana.ai
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://store.office.cn/addinstemplate
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://store.office.de/addinstemplate
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://substrate.office.com
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://substrate.office.com/search/api/v2/init
              Source: Document.doc.scr.exe, 00000000.00000003.1642208886.00000000014B2000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1641926636.00000000014AA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org
              Source: Document.doc.scr.exe, 00000000.00000003.1642208886.00000000014B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
              Source: Document.doc.scr.exe, 00000000.00000003.1642208886.00000000014B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://tasks.office.com
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://templatesmetadata.office.net/
              Source: Document.doc.scr.exe, 00000000.00000003.2091177762.0000000001421000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1734557416.000000000140E000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1907344650.0000000001421000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1661602059.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1908988654.0000000001421000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1910185384.0000000001421000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1650969084.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1648303268.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1912815534.0000000001421000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1675301956.00000000014D5000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1670292404.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1933272646.0000000001421000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000002.2101878302.0000000001421000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1674503550.00000000014D5000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1738608679.000000000140E000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1650588282.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1939184092.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1739871345.000000000140E000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1939350231.0000000001421000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1725687875.000000000140E000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1727469488.000000000140E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tox.chat/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://useraudit.o365auditrealtimeingestion.manage.office.com
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://web.microsoftstream.com/video/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://webshell.suite.office.com
              Source: Document.doc.scr.exe, 00000000.00000003.1645091771.00000000014DF000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1645091771.00000000014D5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://weibo.com/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://word-edit.officeapps.live.com/we/rrdiscovery.ashx
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://wus2.contentsync.
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://wus2.pagecontentsync.
              Source: Document.doc.scr.exe, 00000000.00000003.1645091771.00000000014D5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.aliexpress.com/
              Source: Document.doc.scr.exe, 00000000.00000003.1645091771.00000000014D5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.ca/
              Source: Document.doc.scr.exe, 00000000.00000003.1645091771.00000000014D5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.co.uk/
              Source: Document.doc.scr.exe, 00000000.00000003.1645091771.00000000014D5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.com/
              Source: Document.doc.scr.exe, 00000000.00000003.1641926636.00000000014C2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
              Source: Document.doc.scr.exe, 00000000.00000003.1645091771.00000000014D5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.de/
              Source: Document.doc.scr.exe, 00000000.00000003.1645091771.00000000014D5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.fr/
              Source: Document.doc.scr.exe, 00000000.00000003.1645091771.00000000014D5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avito.ru/
              Source: Document.doc.scr.exe, 00000000.00000003.1645091771.00000000014D5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.bbc.co.uk/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
              Source: Document.doc.scr.exe, 00000000.00000003.1645091771.00000000014D5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ebay.de/
              Source: Document.doc.scr.exe, 00000000.00000003.1641926636.00000000014C2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
              Source: Document.doc.scr.exe, 00000000.00000003.1645091771.00000000014DF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/
              Source: Document.doc.scr.exe, 00000000.00000003.1645091771.00000000014D5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ifeng.com/
              Source: Document.doc.scr.exe, 00000000.00000003.1645091771.00000000014D5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.iqiyi.com/
              Source: Document.doc.scr.exe, 00000000.00000003.1645091771.00000000014D5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.leboncoin.fr/
              Source: Document.doc.scr.exe, 00000000.00000003.1642208886.00000000014B2000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1641926636.00000000014AA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org
              Source: Document.doc.scr.exe, 00000000.00000003.1642208886.00000000014B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
              Source: Document.doc.scr.exe, 00000000.00000003.1642208886.00000000014B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
              Source: Document.doc.scr.exe, 00000000.00000003.1642208886.00000000014B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
              Source: Document.doc.scr.exe, 00000000.00000003.1642208886.00000000014B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
              Source: Document.doc.scr.exe, 00000000.00000003.1873556931.000000000153D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/media/css/privacy_protocol.04de168de977.css
              Source: Document.doc.scr.exe, 00000000.00000003.1642208886.00000000014B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
              Source: Document.doc.scr.exe, 00000000.00000003.1877029171.0000000001526000.00000004.00000020.00020000.00000000.sdmp, 3870112724rsegmnoittet-es.sqlite.jC7CNxlVt.0.drString found in binary or memory: https://www.msn.com
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://www.odwebp.svc.ms
              Source: Document.doc.scr.exe, 00000000.00000003.1645091771.00000000014DF000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1645091771.00000000014D5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.olx.pl/
              Source: Document.doc.scr.exe, 00000000.00000003.1645091771.00000000014D5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.reddit.com/
              Source: Document.doc.scr.exe, 00000000.00000003.1877029171.0000000001526000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.tsn.ca
              Source: Document.doc.scr.exe, 00000000.00000003.1645091771.00000000014D5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.wykop.pl/
              Source: 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drString found in binary or memory: https://www.yammer.com
              Source: Document.doc.scr.exe, 00000000.00000003.1645091771.00000000014DF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.zhihu.com/

              Spam, unwanted Advertisements and Ransom Demands

              barindex
              Found ransom note / readme
              Source: C:\Users\user\AppData\Local\Packages\Microsoft.WebMediaExtensions_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtDropped file: !! ALL YOUR FILES ARE ENCRYPTED !!!You can't restore them without our decryptor.Don't try to use any public tools, you could damage the files and lose them forever.To make sure our decryptor works, contact us and decrypt one file for free.Download TOX messenger: https://tox.chat/Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6Jump to dropped file
              Yara detected LockBit ransomware
              Source: Yara matchFile source: Document.doc.scr.exe, type: SAMPLE
              Source: Yara matchFile source: 0.0.Document.doc.scr.exe.be0000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.2.Document.doc.scr.exe.be0000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.2091177762.00000000013F1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000000.1618448431.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: Document.doc.scr.exe PID: 5320, type: MEMORYSTR
              Yara detected TrojanRansom
              Source: Yara matchFile source: Process Memory Space: Document.doc.scr.exe PID: 5320, type: MEMORYSTR
              Changes the wallpaper picture
              Source: C:\Users\user\Desktop\Document.doc.scr.exeKey value created or modified: HKEY_CURRENT_USER\Control Panel\Desktop WallPaper C:\ProgramData\jC7CNxlVt.bmpJump to behavior
              Found potential ransomware demand text
              Source: Document.doc.scr.exe, 00000000.00000003.2091177762.00000000013F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encrypted
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : All your important files are stolen and encrypted!
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encrypted,7
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encrypted:7
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encrypted07
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encryptedR7
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encryptedh7
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encrypted
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encryptedl
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encrypted>6
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encrypted46
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encryptedB6
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encryptedX6
              Source: Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encryptedV6
              Modifies existing user documents (likely ransomware behavior)
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile moved: C:\Users\user\Desktop\AIXACVYBSB\XZXHAVGRAG.pdfJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile moved: C:\Users\user\Desktop\XZXHAVGRAG\XZXHAVGRAG.docxJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile moved: C:\Users\user\Desktop\BPMLNOBVSB.mp3Jump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile moved: C:\Users\user\Desktop\AIXACVYBSB\AIXACVYBSB.docxJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile moved: C:\Users\user\Desktop\VLZDGUKUTZ.pngJump to behavior
              Writes many files with high entropy
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\Settings.ft.jC7CNxlVt entropy: 7.99924167215Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\0.0.filtertrie.intermediate.txt.jC7CNxlVt entropy: 7.99916926048Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\Settings.ft.jC7CNxlVt entropy: 7.99913941687Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingsglobals.txt.jC7CNxlVt entropy: 7.99587528156Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c58f7468-b990-418e-a4ba-ca3568b01c70}\Apps.ft.jC7CNxlVt entropy: 7.99571821978Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appsglobals.txt.jC7CNxlVt entropy: 7.99946553555Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appssynonyms.txt.jC7CNxlVt entropy: 7.99926475323Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c58f7468-b990-418e-a4ba-ca3568b01c70}\0.0.filtertrie.intermediate.txt.jC7CNxlVt entropy: 7.99519418233Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Chrome.jC7CNxlVt entropy: 7.99550186667Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\308046B0AF4A39CB.jC7CNxlVt entropy: 7.99437178053Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingsconversions.txt.jC7CNxlVt entropy: 7.99751125068Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\Apps.ft.jC7CNxlVt entropy: 7.99630167281Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\0.0.filtertrie.intermediate.txt.jC7CNxlVt entropy: 7.99520562394Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\wct38F0.tmp.jC7CNxlVt entropy: 7.99775158339Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingssynonyms.txt.jC7CNxlVt entropy: 7.99802208777Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\wct443C.tmp.jC7CNxlVt entropy: 7.99684378584Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\wctAB5F.tmp.jC7CNxlVt entropy: 7.99764639052Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\wctE4A4.tmp.jC7CNxlVt entropy: 7.99777847377Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\wctDB2E.tmp.jC7CNxlVt entropy: 7.99717599045Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\wctEA40.tmp.jC7CNxlVt entropy: 7.99728743364Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\wct49A7.tmp.jC7CNxlVt entropy: 7.9970471531Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\wctF411.tmp.jC7CNxlVt entropy: 7.9972650729Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{16988324-21C9-05B2-CA60-9B4EC72739D8}.jC7CNxlVt entropy: 7.99474390029Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\https___java_com_help.jC7CNxlVt entropy: 7.99513294948Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\https___java_com_.jC7CNxlVt entropy: 7.99487891406Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Chrome__crx_mpnpojknpmnjdcgaaiekajbnjb.jC7CNxlVt entropy: 7.99505067124Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Chrome__crx_kefjledonknomlcbpllchaibag.jC7CNxlVt entropy: 7.99525109467Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Chrome__crx_fmgjjmmmlfcabfkddbjimcfncm.jC7CNxlVt entropy: 7.99513540808Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Chrome__crx_fhihpiojkboajapmgkhlnakfjf.jC7CNxlVt entropy: 7.99457877648Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Chrome__crx_agimnkijcamfeangaknmldooml.jC7CNxlVt entropy: 7.99454862868Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Chrome__crx_aghbiahbpaeidepookljebhfak.jC7CNxlVt entropy: 7.99512466125Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\308046B0AF4A39CB;PrivateBrowsingAUMID.jC7CNxlVt entropy: 7.99508738469Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{E8B84CFB-B069-BC13-F88F-170904F645E5}.jC7CNxlVt entropy: 7.99537949105Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{E7A33582-E908-3379-5368-5999454DCD83}.jC7CNxlVt entropy: 7.99521302446Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{DAA168DE-4306-C8BC-8C11-B596240BDDED}.jC7CNxlVt entropy: 7.99600003865Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{C804BBA7-FA5F-CBF7-8B55-2096E5F972CB}.jC7CNxlVt entropy: 7.99438343854Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{C1C6F8AC-40A3-0F5C-146F-65A9DC70BBB4}.jC7CNxlVt entropy: 7.99469315973Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{BD3F924E-55FB-A1BA-9DE6-B50F9F2460AC}.jC7CNxlVt entropy: 7.99536227861Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{923DD477-5846-686B-A659-0FCCD73851A8}.jC7CNxlVt entropy: 7.99484256107Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{BB044BFD-25B7-2FAA-22A8-6371A93E0456}.jC7CNxlVt entropy: 7.99434698097Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{8AA47365-B2B3-1961-69EB-F866E376B12F}.jC7CNxlVt entropy: 7.99534877449Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{8ABD94FB-E7D6-84A6-A997-C918EDDE0AE5}.jC7CNxlVt entropy: 7.99548532046Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{116229A7-9A3B-2078-DB5F-B5A20811242C}.jC7CNxlVt entropy: 7.99548160641Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696334775820156800_6EB929AF-656E-4F43-9731-EA7753E1F1BD.log.jC7CNxlVt entropy: 7.99126919535Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696334923056622400_BD966DD2-7850-423A-B1D8-7882CE1A6D15.log.jC7CNxlVt entropy: 7.99899371601Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_InternetExplorer_Default.jC7CNxlVt entropy: 7.99471348972Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696417072488237400_C12D9B44-3468-47BC-9418-BF0A674A2B2F.log.jC7CNxlVt entropy: 7.99920552342Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{F1118828-A0CC-5FEB-85C9-DBFFDF98434A}.jC7CNxlVt entropy: 7.99491869986Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696417101742322600_290EFEE9-C25A-4857-9F32-D7E6D51B7C09.log.jC7CNxlVt entropy: 7.99908159873Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696417118050662300_8475A8C9-2447-4BC4-8E46-350AA0582B94.log.jC7CNxlVt entropy: 7.99879038893Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_OUTLOOK_EXE_15.jC7CNxlVt entropy: 7.99484994689Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_ONENOTE_EXE_15.jC7CNxlVt entropy: 7.99484289482Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_OcPubMgr_exe_15.jC7CNxlVt entropy: 7.99540865791Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_MSPUB_EXE_15.jC7CNxlVt entropy: 7.99473186797Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_MSOUC_EXE_15.jC7CNxlVt entropy: 7.9952028162Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_msoev_exe_15.jC7CNxlVt entropy: 7.99475206329Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_MSACCESS_EXE_15.jC7CNxlVt entropy: 7.99528224786Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App_1696413198165042300_AA3FCB9C-CF1A-4407-8A94-A7D6C220021F.log.jC7CNxlVt entropy: 7.99887297564Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt.jC7CNxlVt entropy: 7.99334162009Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_lync_exe_15.jC7CNxlVt entropy: 7.9948391078Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2023-10-04 13-00-50-743.log.jC7CNxlVt entropy: 7.99077474112Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_EXCEL_EXE_15.jC7CNxlVt entropy: 7.99561898898Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_DATABASECOMPARE_EXE_15.jC7CNxlVt entropy: 7.99584091099Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SPREADSHEETCOMPARE_EXE_15.jC7CNxlVt entropy: 7.99467960759Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_WindowsCalculator_8wekyb3d8bbwe!App.jC7CNxlVt entropy: 7.99552035638Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_WindowsAlarms_8wekyb3d8bbwe!App.jC7CNxlVt entropy: 7.99514409216Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_SkyDrive_Desktop.jC7CNxlVt entropy: 7.99462038558Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_WINWORD_EXE_15.jC7CNxlVt entropy: 7.99540283131Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15.jC7CNxlVt entropy: 7.99529054179Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_POWERPNT_EXE_15.jC7CNxlVt entropy: 7.99515790008Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_MediaPlayer32.jC7CNxlVt entropy: 7.99533840617Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer.jC7CNxlVt entropy: 7.99452677495Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_ControlPanel.jC7CNxlVt entropy: 7.99511357476Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Computer.jC7CNxlVt entropy: 7.99548553849Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_AdministrativeTools.jC7CNxlVt entropy: 7.99497582878Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_WindowsStore_8wekyb3d8bbwe!App.jC7CNxlVt entropy: 7.99474576978Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_WindowsSoundRecorder_8wekyb3d8bbwe!App.jC7CNxlVt entropy: 7.99555784153Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite.jC7CNxlVt entropy: 7.99938991158Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite.jC7CNxlVt entropy: 7.99812928036Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm.jC7CNxlVt entropy: 7.99457825389Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions.json.jC7CNxlVt entropy: 7.9950710788Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm.jC7CNxlVt entropy: 7.9941473817Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db.jC7CNxlVt entropy: 7.99935317412Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite.jC7CNxlVt entropy: 7.99824885033Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite.jC7CNxlVt entropy: 7.9971172896Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm.jC7CNxlVt entropy: 7.99402696041Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite.jC7CNxlVt entropy: 7.99826307285Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-shm.jC7CNxlVt entropy: 7.99501442195Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite.jC7CNxlVt entropy: 7.99865317803Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.jC7CNxlVt entropy: 7.99606416884Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm.jC7CNxlVt entropy: 7.99385745121Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite.jC7CNxlVt entropy: 7.99632610207Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm.jC7CNxlVt entropy: 7.9953891329Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.jC7CNxlVt entropy: 7.99586231709Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm.jC7CNxlVt entropy: 7.99429265165Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.jC7CNxlVt entropy: 7.99678680247Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm.jC7CNxlVt entropy: 7.99449233071Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.jC7CNxlVt entropy: 7.99621407383Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\trash16598\13723.jC7CNxlVt entropy: 7.9958708614Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm.jC7CNxlVt entropy: 7.99491861153Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm.jC7CNxlVt entropy: 7.99483146011Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\2275F9569F28969C8FC69F9660A75ADD1F8B963B.jC7CNxlVt entropy: 7.99180646076Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\2B8DB5289EFF0A466C21F47412A322A36CEB5044.jC7CNxlVt entropy: 7.99840172983Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\289DBE90018D682BDBFD59A3CAACE9EE538234FD.jC7CNxlVt entropy: 7.99184137632Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\252CE8AC445A184A1F4A1C6C6D4ADB8AE41B7776.jC7CNxlVt entropy: 7.99759560548Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\22F59957B7E08CD6CCFED6AF2A1DF26FE157DF40.jC7CNxlVt entropy: 7.99838363669Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\7278f154-e8f4-4235-84c5-c5c1c6af0084.jC7CNxlVt entropy: 7.99759497552Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\3C9B2D192D535C347CDA9FB12BFC88FD40CF0382.jC7CNxlVt entropy: 7.99817444782Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\62FC1E8DCE1991EEB55DE9EFADF47EA578A22AB5.jC7CNxlVt entropy: 7.99289299885Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\44230749A38B6989F56217B435A03E84CCADE62D.jC7CNxlVt entropy: 7.99315241269Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\BDE5E55BCB4604200C70FB908FA76903C94590D3.jC7CNxlVt entropy: 7.99843877927Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829744.7278f154-e8f4-4235-84c5-c5c1c6af0084.main.jsonlz4.jC7CNxlVt entropy: 7.99120527429Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\D0F48A0632B6C451791F4257697E861961F06A6F.jC7CNxlVt entropy: 7.99529010681Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\E707EC8A256322E87908664A49F800B7B48E0961.jC7CNxlVt entropy: 7.99155975092Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db.jC7CNxlVt entropy: 7.99609399172Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\doomed\11719.jC7CNxlVt entropy: 7.99419171554Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State.jC7CNxlVt entropy: 7.99745047365Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1.jC7CNxlVt entropy: 7.99939529516Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\ShaderCache\index.jC7CNxlVt entropy: 7.99923561046Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Shell_RunDialog.jC7CNxlVt entropy: 7.99420693218Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_RemoteDesktop.jC7CNxlVt entropy: 7.99507827028Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Photos_8wekyb3d8bbwe!App.jC7CNxlVt entropy: 7.99392350591Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\MSEdge.jC7CNxlVt entropy: 7.99475420587Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_MdSched_exe.jC7CNxlVt entropy: 7.99552259954Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_mspaint_exe.jC7CNxlVt entropy: 7.99533285165Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_msinfo32_exe.jC7CNxlVt entropy: 7.99433212335Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_magnify_exe.jC7CNxlVt entropy: 7.99499141084Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_iscsicpl_exe.jC7CNxlVt entropy: 7.99418100373Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_dfrgui_exe.jC7CNxlVt entropy: 7.9948073713Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_comexp_msc.jC7CNxlVt entropy: 7.99483550575Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_cleanmgr_exe.jC7CNxlVt entropy: 7.99459935545Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_cmd_exe.jC7CNxlVt entropy: 7.99497350251Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_charmap_exe.jC7CNxlVt entropy: 7.99502461523Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_msconfig_exe.jC7CNxlVt entropy: 7.99470960011Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_WFS_exe.jC7CNxlVt entropy: 7.99445822545Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_SnippingTool_exe.jC7CNxlVt entropy: 7.99422636889Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_services_msc.jC7CNxlVt entropy: 7.99464075542Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_RecoveryDrive_exe.jC7CNxlVt entropy: 7.99532342466Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_quickassist_exe.jC7CNxlVt entropy: 7.99455855967Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_psr_exe.jC7CNxlVt entropy: 7.99525636834Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_printmanagement_msc.jC7CNxlVt entropy: 7.99548440016Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_odbcad32_exe.jC7CNxlVt entropy: 7.99483249281Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_osk_exe.jC7CNxlVt entropy: 7.99560932007Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_notepad_exe.jC7CNxlVt entropy: 7.99535850542Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_narrator_exe.jC7CNxlVt entropy: 7.9950320775Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Aut2Exe_Aut2exe_exe.jC7CNxlVt entropy: 7.99540839943Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Au3Info_x64_exe.jC7CNxlVt entropy: 7.99537669522Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Au3Info_exe.jC7CNxlVt entropy: 7.99530277436Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_Windows NT_Accessories_wordpad_exe.jC7CNxlVt entropy: 7.99547471331Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_Common Files_Microsoft Shared_Ink_mip_exe.jC7CNxlVt entropy: 7.99485412095Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_Adobe_Acrobat DC_Acrobat_Acrobat_exe.jC7CNxlVt entropy: 7.99475500883Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_7-Zip_7zFM_exe.jC7CNxlVt entropy: 7.99496082952Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_7-Zip_7-zip_chm.jC7CNxlVt entropy: 7.99429785307Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_WindowsPowerShell_v1_0_PowerShell_ISE_exe.jC7CNxlVt entropy: 7.99571809697Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_WindowsPowerShell_v1_0_powershell_exe.jC7CNxlVt entropy: 7.99552924913Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_WF_msc.jC7CNxlVt entropy: 7.99498046183Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}_odbcad32_exe.jC7CNxlVt entropy: 7.99545516285Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_Java_jre-1_8_bin_javacpl_exe.jC7CNxlVt entropy: 7.99497295912Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_SciTE_SciTE_exe.jC7CNxlVt entropy: 7.99534775154Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Extras.jC7CNxlVt entropy: 7.99479086452Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Examples.jC7CNxlVt entropy: 7.99522017998Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoIt_chm.jC7CNxlVt entropy: 7.99567538687Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoItX_AutoItX_chm.jC7CNxlVt entropy: 7.9952840207Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoIt3_x64_exe.jC7CNxlVt entropy: 7.99517945582Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoIt3_exe.jC7CNxlVt entropy: 7.99524115439Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoIt v3 Website_url.jC7CNxlVt entropy: 7.9953316903Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Aut2Exe_Aut2exe_x64_exe.jC7CNxlVt entropy: 7.99532659724Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb00001.log.jC7CNxlVt entropy: 7.99957823513Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00001.jrs.jC7CNxlVt entropy: 7.99970728937Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.log.jC7CNxlVt entropy: 7.99962404246Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1.jC7CNxlVt entropy: 7.99933453606Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{F38BF404-1D43-42F2-9305-67DE0B28FC23}_regedit_exe.jC7CNxlVt entropy: 7.99588035337Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}_WindowsPowerShell_v1_0_PowerShell_ISE_exe.jC7CNxlVt entropy: 7.99560987088Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}_WindowsPowerShell_v1_0_powershell_exe.jC7CNxlVt entropy: 7.99504815394Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbtmp.log.jC7CNxlVt entropy: 7.99965299911Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00002.jrs.jC7CNxlVt entropy: 7.99963141435Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\index.jC7CNxlVt entropy: 7.99930314827Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1.jC7CNxlVt entropy: 7.99937356398Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\GrShaderCache\index.jC7CNxlVt entropy: 7.99933631727Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppTracing_startedInBGMode.etl.jC7CNxlVt entropy: 7.99724191844Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite-shm.jC7CNxlVt entropy: 7.99520871505Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db-shm.jC7CNxlVt entropy: 7.99425486193Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei.jC7CNxlVt entropy: 7.99306983874Jump to dropped file
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl.jC7CNxlVt entropy: 7.99756229276Jump to dropped file
              Source: C:\ProgramData\D448.tmpFile created: C:\Users\user\Desktop\Document.doc.scr.exe entropy: 7.9972061867Jump to dropped file
              Source: C:\ProgramData\D448.tmpFile created: C:\Users\user\Desktop\AAAAAAAAAAAAAAAAAAAA (copy) entropy: 7.9972061867Jump to dropped file
              Source: C:\ProgramData\D448.tmpFile created: C:\Users\user\Desktop\BBBBBBBBBBBBBBBBBBBB (copy) entropy: 7.9972061867Jump to dropped file
              Source: C:\ProgramData\D448.tmpFile created: C:\Users\user\Desktop\CCCCCCCCCCCCCCCCCCCC (copy) entropy: 7.9972061867Jump to dropped file
              Source: C:\ProgramData\D448.tmpFile created: C:\Users\user\Desktop\DDDDDDDDDDDDDDDDDDDD (copy) entropy: 7.9972061867Jump to dropped file
              Source: C:\ProgramData\D448.tmpFile created: C:\Users\user\Desktop\EEEEEEEEEEEEEEEEEEEE (copy) entropy: 7.9972061867Jump to dropped file
              Source: C:\ProgramData\D448.tmpFile created: C:\Users\user\Desktop\FFFFFFFFFFFFFFFFFFFF (copy) entropy: 7.9972061867Jump to dropped file
              Source: C:\ProgramData\D448.tmpFile created: C:\Users\user\Desktop\GGGGGGGGGGGGGGGGGGGG (copy) entropy: 7.9972061867Jump to dropped file
              Source: C:\ProgramData\D448.tmpFile created: C:\Users\user\Desktop\HHHHHHHHHHHHHHHHHHHH (copy) entropy: 7.9972061867Jump to dropped file
              Source: C:\ProgramData\D448.tmpFile created: C:\Users\user\Desktop\IIIIIIIIIIIIIIIIIIII (copy) entropy: 7.9972061867Jump to dropped file
              Source: C:\ProgramData\D448.tmpFile created: C:\Users\user\Desktop\JJJJJJJJJJJJJJJJJJJJ (copy) entropy: 7.9972061867Jump to dropped file
              Source: C:\ProgramData\D448.tmpFile created: C:\Users\user\Desktop\KKKKKKKKKKKKKKKKKKKK (copy) entropy: 7.9972061867Jump to dropped file
              Source: C:\ProgramData\D448.tmpFile created: C:\Users\user\Desktop\LLLLLLLLLLLLLLLLLLLL (copy) entropy: 7.9972061867Jump to dropped file
              Source: C:\ProgramData\D448.tmpFile created: C:\Users\user\Desktop\MMMMMMMMMMMMMMMMMMMM (copy) entropy: 7.9972061867Jump to dropped file
              Source: C:\ProgramData\D448.tmpFile created: C:\Users\user\Desktop\NNNNNNNNNNNNNNNNNNNN (copy) entropy: 7.9972061867Jump to dropped file
              Source: C:\ProgramData\D448.tmpFile created: C:\Users\user\Desktop\OOOOOOOOOOOOOOOOOOOO (copy) entropy: 7.9972061867Jump to dropped file
              Source: C:\ProgramData\D448.tmpFile created: C:\Users\user\Desktop\PPPPPPPPPPPPPPPPPPPP (copy) entropy: 7.9972061867Jump to dropped file
              Source: C:\ProgramData\D448.tmpFile created: C:\Users\user\Desktop\QQQQQQQQQQQQQQQQQQQQ (copy) entropy: 7.9972061867Jump to dropped file
              Source: C:\ProgramData\D448.tmpFile created: C:\Users\user\Desktop\RRRRRRRRRRRRRRRRRRRR (copy) entropy: 7.9972061867Jump to dropped file
              Source: C:\ProgramData\D448.tmpFile created: C:\Users\user\Desktop\SSSSSSSSSSSSSSSSSSSS (copy) entropy: 7.9972061867Jump to dropped file
              Source: C:\ProgramData\D448.tmpFile created: C:\Users\user\Desktop\TTTTTTTTTTTTTTTTTTTT (copy) entropy: 7.9972061867Jump to dropped file
              Source: C:\ProgramData\D448.tmpFile created: C:\Users\user\Desktop\UUUUUUUUUUUUUUUUUUUU (copy) entropy: 7.9972061867Jump to dropped file
              Source: C:\ProgramData\D448.tmpFile created: C:\Users\user\Desktop\VVVVVVVVVVVVVVVVVVVV (copy) entropy: 7.9972061867Jump to dropped file
              Source: C:\ProgramData\D448.tmpFile created: C:\Users\user\Desktop\WWWWWWWWWWWWWWWWWWWW (copy) entropy: 7.9972061867Jump to dropped file
              Source: C:\ProgramData\D448.tmpFile created: C:\Users\user\Desktop\XXXXXXXXXXXXXXXXXXXX (copy) entropy: 7.9972061867Jump to dropped file
              Source: C:\ProgramData\D448.tmpFile created: C:\Users\user\Desktop\YYYYYYYYYYYYYYYYYYYY (copy) entropy: 7.9972061867Jump to dropped file
              Source: C:\ProgramData\D448.tmpFile created: C:\Users\user\Desktop\ZZZZZZZZZZZZZZZZZZZZ (copy) entropy: 7.9972061867Jump to dropped file

              System Summary

              barindex
              Malicious sample detected (through community Yara rule)
              Source: Document.doc.scr.exe, type: SAMPLEMatched rule: Windows_Ransomware_Lockbit_369e1e94 Author: unknown
              Source: 0.0.Document.doc.scr.exe.be0000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Lockbit_369e1e94 Author: unknown
              Source: 0.2.Document.doc.scr.exe.be0000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Lockbit_369e1e94 Author: unknown
              Source: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Lockbit_369e1e94 Author: unknown
              Source: 00000000.00000000.1618448431.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Lockbit_369e1e94 Author: unknown
              Initial sample is a PE file and has a suspicious name
              Source: initial sampleStatic PE information: Filename: Document.doc.scr.exe
              Sample has a suspicious name (potential lure to open the executable)
              Source: Document.doc.scr.exeStatic file information: Suspicious name
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BF04B4 GetTempFileNameW,CreateFileW,WriteFile,CreateProcessW,NtQueryInformationProcess,NtReadVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,CreateNamedPipeW,ResumeThread,ConnectNamedPipe,0_2_00BF04B4
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BE6C98 NtQueryInformationToken,0_2_00BE6C98
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BE9880 NtClose,0_2_00BE9880
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BF7034 CreateThread,CreateThread,CreateThread,CreateThread,NtTerminateThread,CreateThread,CreateThread,0_2_00BF7034
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BEB470 NtProtectVirtualMemory,0_2_00BEB470
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BEDC60 NtTerminateProcess,0_2_00BEDC60
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BEB444 NtSetInformationThread,0_2_00BEB444
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BEE1E8 CreateThread,NtClose,0_2_00BEE1E8
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BEC28C CreateFileW,WriteFile,WriteFile,NtClose,WriteFile,WriteFile,0_2_00BEC28C
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BEDE78 SetThreadPriority,ReadFile,WriteFile,WriteFile,NtClose,0_2_00BEDE78
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BEB674 NtQueryInformationToken,0_2_00BEB674
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BE6668 CreateFileW,NtAllocateVirtualMemory,WriteFile,SetFilePointerEx,NtFreeVirtualMemory,DeleteFileW,0_2_00BE6668
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BE7E58 NtQuerySystemInformation,Sleep,0_2_00BE7E58
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BEC3F8 CreateFileW,WriteFile,RegCreateKeyExW,RegSetValueExW,RegCreateKeyExW,RegSetValueExW,SHChangeNotify,NtClose,0_2_00BEC3F8
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BE97D8 NtQuerySystemInformation,0_2_00BE97D8
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BEB3C0 NtSetInformationThread,NtClose,0_2_00BEB3C0
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BEB734 NtSetInformationProcess,NtSetInformationProcess,NtSetInformationProcess,0_2_00BEB734
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BE8F68 RtlAdjustPrivilege,NtSetInformationThread,0_2_00BE8F68
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BE982A NtQuerySystemInformation,0_2_00BE982A
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BE9811 NtQuerySystemInformation,0_2_00BE9811
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BE7EA3 NtQuerySystemInformation,Sleep,0_2_00BE7EA3
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BE7E8A NtQuerySystemInformation,Sleep,0_2_00BE7E8A
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BE8F66 RtlAdjustPrivilege,NtSetInformationThread,0_2_00BE8F66
              Source: C:\ProgramData\D448.tmpCode function: 9_2_00402760 CreateFileW,ReadFile,NtClose,9_2_00402760
              Source: C:\ProgramData\D448.tmpCode function: 9_2_0040286C NtSetInformationProcess,NtSetInformationProcess,NtSetInformationProcess,9_2_0040286C
              Source: C:\ProgramData\D448.tmpCode function: 9_2_00402F18 CreateFileW,NtAllocateVirtualMemory,WriteFile,SetFilePointerEx,SetFilePointerEx,NtFreeVirtualMemory,NtClose,DeleteFileW,9_2_00402F18
              Source: C:\ProgramData\D448.tmpCode function: 9_2_00401DC2 NtProtectVirtualMemory,9_2_00401DC2
              Source: C:\ProgramData\D448.tmpCode function: 9_2_00401D94 NtSetInformationThread,9_2_00401D94
              Source: C:\ProgramData\D448.tmpCode function: 9_2_004016B4 NtAllocateVirtualMemory,NtAllocateVirtualMemory,9_2_004016B4
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BEA68C: GetVolumeNameForVolumeMountPointW,FindFirstVolumeW,GetVolumePathNamesForVolumeNameW,GetDriveTypeW,CreateFileW,DeviceIoControl,FindVolumeClose,0_2_00BEA68C
              Source: C:\Windows\splwow64.exeFile created: C:\Windows\system32\spool\PRINTERS\00002.SPL
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BE80B80_2_00BE80B8
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BE20AC0_2_00BE20AC
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BE4D080_2_00BE4D08
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BE4D030_2_00BE4D03
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BE52180_2_00BE5218
              Source: C:\Users\user\Desktop\Document.doc.scr.exeProcess token adjusted: Security
              Source: Document.doc.scr.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
              Source: Document.doc.scr.exe, type: SAMPLEMatched rule: Windows_Ransomware_Lockbit_369e1e94 reference_sample = d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee, os = windows, severity = x86, creation_date = 2022-07-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = 9cf4c112c0ee708ae64052926681e8351f1ccefeb558c41e875dbd9e4bdcb5f2, id = 369e1e94-3fbb-4828-bb78-89d26e008105, last_modified = 2022-07-18
              Source: 0.0.Document.doc.scr.exe.be0000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Lockbit_369e1e94 reference_sample = d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee, os = windows, severity = x86, creation_date = 2022-07-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = 9cf4c112c0ee708ae64052926681e8351f1ccefeb558c41e875dbd9e4bdcb5f2, id = 369e1e94-3fbb-4828-bb78-89d26e008105, last_modified = 2022-07-18
              Source: 0.2.Document.doc.scr.exe.be0000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Lockbit_369e1e94 reference_sample = d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee, os = windows, severity = x86, creation_date = 2022-07-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = 9cf4c112c0ee708ae64052926681e8351f1ccefeb558c41e875dbd9e4bdcb5f2, id = 369e1e94-3fbb-4828-bb78-89d26e008105, last_modified = 2022-07-18
              Source: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Lockbit_369e1e94 reference_sample = d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee, os = windows, severity = x86, creation_date = 2022-07-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = 9cf4c112c0ee708ae64052926681e8351f1ccefeb558c41e875dbd9e4bdcb5f2, id = 369e1e94-3fbb-4828-bb78-89d26e008105, last_modified = 2022-07-18
              Source: 00000000.00000000.1618448431.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Lockbit_369e1e94 reference_sample = d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee, os = windows, severity = x86, creation_date = 2022-07-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = 9cf4c112c0ee708ae64052926681e8351f1ccefeb558c41e875dbd9e4bdcb5f2, id = 369e1e94-3fbb-4828-bb78-89d26e008105, last_modified = 2022-07-18
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\block.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\nkp.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\usb.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\tcglib.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\guiddef.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\ramapi.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\diskapi.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\sdiapi.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\blockapi.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\uwfapi.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\locate.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\disk.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\sdiapi.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\blktable.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\blocksup.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\partapi.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\uwfapi.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\ramapi.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\debugport.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\debugport.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\fve.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\fvelog.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\fveretailunlock.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\blktable.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\udp.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\seccmd.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\uriapi.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\fveretailunlock.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\fvelog.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\vhdutil.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\vmbusapi.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\blockapi.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\vdiskapi.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\seccmd.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\fileapi.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\serialapi.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\ramdiskvhd.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\vhd.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\fve.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\device.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\edriveapi.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\vmbusapi.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\nbp.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\nkp.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\usb.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\blkcache.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\disk.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\locate.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\block.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\edriveapi.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\fileapi.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\udp.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\device.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\serialapi.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\vmbus.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\vmbus.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\devlog.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\vhd2.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\blocksup.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\partition.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\blkcache.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\uriapi.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\guiddef.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\tcglib.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\ramdiskvhd.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\vdiskapi.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\devlog.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\vhdutil.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\vhd2.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\partapi.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\udpapi.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\udpapi.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\partition.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\nbp.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\diskapi.obj
              Source: download.error.jC7CNxlVt.0.drBinary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\vhd.obj
              Source: Apps.index.jC7CNxlVt.0.drBinary or memory string: s.sln
              Source: classification engineClassification label: mal100.rans.phis.spyw.evad.winEXE@9/1664@0/0
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeMutant created: \Sessions\1\BaseNamedObjects\Global\705c7244f57fd9120d0c7bfadb7dbc11
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4828:120:WilError_03
              Source: C:\ProgramData\D448.tmpMutant created: \Sessions\1\BaseNamedObjects\Global\{649F4E29-16CB-DD42-8922-9FFF0592856B}
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Windows\splwow64.exeFile read: C:\Windows\System32\DriverStore\FileRepository\prnms006.inf_amd64_c3bdcb6fc975b614\SendToOneNote-manifest.ini
              Source: C:\Users\user\Desktop\Document.doc.scr.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: Document.doc.scr.exeReversingLabs: Detection: 86%
              Source: Document.doc.scr.exeVirustotal: Detection: 86%
              Source: unknownProcess created: C:\Users\user\Desktop\Document.doc.scr.exe "C:\Users\user\Desktop\Document.doc.scr.exe"
              Source: C:\Users\user\Desktop\Document.doc.scr.exeProcess created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
              Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE /insertdoc "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\{E6830A1B-81EB-4C98-A5C6-BA0FB0C332A2}.xps" 133585893886890000
              Source: C:\Users\user\Desktop\Document.doc.scr.exeProcess created: C:\ProgramData\D448.tmp "C:\ProgramData\D448.tmp"
              Source: C:\ProgramData\D448.tmpProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D448.tmp >> NUL
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\Document.doc.scr.exeProcess created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288Jump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeProcess created: C:\ProgramData\D448.tmp "C:\ProgramData\D448.tmp"Jump to behavior
              Source: C:\ProgramData\D448.tmpProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D448.tmp >> NUL
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: wtsapi32.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: rstrtmgr.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: ncrypt.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: ntasn1.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: netapi32.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: wkscli.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: srvcli.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: samcli.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: logoncli.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: activeds.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: adsldpc.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: wininet.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: wsock32.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: mpr.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: gpedit.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: gpapi.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: dssec.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: dsuiext.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: framedynos.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: dsrole.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: ntdsapi.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: authz.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: ntmarta.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: version.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: adsldp.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: sxs.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: dnsapi.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: mscms.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: coloradapterclient.dllJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeSection loaded: textshaping.dllJump to behavior
              Source: C:\ProgramData\D448.tmpSection loaded: apphelp.dll
              Source: C:\ProgramData\D448.tmpSection loaded: rstrtmgr.dll
              Source: C:\ProgramData\D448.tmpSection loaded: ncrypt.dll
              Source: C:\ProgramData\D448.tmpSection loaded: ntasn1.dll
              Source: C:\ProgramData\D448.tmpSection loaded: windows.storage.dll
              Source: C:\ProgramData\D448.tmpSection loaded: wldp.dll
              Source: C:\ProgramData\D448.tmpSection loaded: kernel.appcore.dll
              Source: C:\ProgramData\D448.tmpSection loaded: uxtheme.dll
              Source: C:\ProgramData\D448.tmpSection loaded: propsys.dll
              Source: C:\ProgramData\D448.tmpSection loaded: profapi.dll
              Source: C:\ProgramData\D448.tmpSection loaded: edputil.dll
              Source: C:\ProgramData\D448.tmpSection loaded: urlmon.dll
              Source: C:\ProgramData\D448.tmpSection loaded: iertutil.dll
              Source: C:\ProgramData\D448.tmpSection loaded: srvcli.dll
              Source: C:\ProgramData\D448.tmpSection loaded: netutils.dll
              Source: C:\ProgramData\D448.tmpSection loaded: windows.staterepositoryps.dll
              Source: C:\ProgramData\D448.tmpSection loaded: sspicli.dll
              Source: C:\ProgramData\D448.tmpSection loaded: wintypes.dll
              Source: C:\ProgramData\D448.tmpSection loaded: appresolver.dll
              Source: C:\ProgramData\D448.tmpSection loaded: bcp47langs.dll
              Source: C:\ProgramData\D448.tmpSection loaded: slc.dll
              Source: C:\ProgramData\D448.tmpSection loaded: userenv.dll
              Source: C:\ProgramData\D448.tmpSection loaded: sppc.dll
              Source: C:\ProgramData\D448.tmpSection loaded: onecorecommonproxystub.dll
              Source: C:\ProgramData\D448.tmpSection loaded: onecoreuapcommonproxystub.dll
              Source: C:\Users\user\Desktop\Document.doc.scr.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}\InprocServer32Jump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile written: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.iniJump to behavior
              Source: Window RecorderWindow detected: More than 3 window changes detected
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
              Source: Document.doc.scr.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
              Source: Document.doc.scr.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
              Source: Binary string: ice\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\C7CNxlVt.README.txt source: Document.doc.scr.exe, 00000000.00000003.1682283519.00000000014FE000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2_0 source: Document.doc.scr.exe, 00000000.00000003.1682283519.00000000014FE000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\j source: Document.doc.scr.exe, 00000000.00000003.1682283519.00000000014FE000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\* source: Document.doc.scr.exe, 00000000.00000003.1682283519.00000000014FE000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.jC7CNxlVt source: Document.doc.scr.exe, 00000000.00000003.1705221595.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1711836076.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1718849776.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1717159713.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1718983651.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1703476299.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1710511244.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1712643035.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1686082464.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1713658697.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1715185404.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1695151935.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1719812875.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1711697152.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1699369432.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1694880017.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1680648061.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1712214810.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1720140260.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1693739427.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1719287121.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1714611951.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1701452290.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1702773878.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1714096402.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1705906875.000000000143D000.00000004.00000020.00020000.00000000.sdmp, Document.d
              Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: Document.doc.scr.exe, 00000000.00000003.1939184092.00000000013CF000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013AE000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: WINLOA~1.PDBwinload_prod.pdb source: Document.doc.scr.exe, 00000000.00000003.1679982073.0000000001426000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2p source: Document.doc.scr.exe, 00000000.00000003.1682283519.00000000014FE000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: mi_exe_stub.pdb source: Document.doc.scr.exe, 00000000.00000003.1678909255.0000000001487000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1678737768.0000000001474000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\jC7CNxlVt.README.txt source: Document.doc.scr.exe, 00000000.00000003.1680648061.000000000143D000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: WINLOA~1.PDBntkrnlmp.pdb.pdb source: Document.doc.scr.exe, 00000000.00000003.1680648061.0000000001426000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.jC7CNxlVte source: Document.doc.scr.exe, 00000000.00000003.1680648061.000000000143D000.00000004.00000020.00020000.00000000.sdmp
              Source: Document.doc.scr.exeStatic PE information: real checksum: 0x266aa should be: 0x3bee8
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BE61EE push esp; retf 0_2_00BE61F6
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BE35D5 push 0000006Ah; retf 0_2_00BE3644
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BE35D3 push 0000006Ah; retf 0_2_00BE3644
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BE356B push 0000006Ah; retf 0_2_00BE3644
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Videos\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Searches\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Saved Games\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Recent\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Pictures\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Pictures\Saved Pictures\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Pictures\Camera Roll\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\OneDrive\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Music\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Links\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Favorites\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Favorites\Links\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Downloads\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Documents\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Documents\ZQIXMVQGAH\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Documents\ZBEDCJPBEY\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Documents\XZXHAVGRAG\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Documents\VAMYDFPUND\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Documents\SFPUSAFIOL\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Documents\ONBQCLYSPU\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Documents\KZWFNRXYKI\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Documents\KATAXZVCPS\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Documents\HTAGVDFUIE\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Documents\DTBZGIOOSO\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Documents\CURQNKVOIX\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Documents\AIXACVYBSB\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Desktop\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Desktop\ZQIXMVQGAH\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Desktop\ZBEDCJPBEY\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Desktop\XZXHAVGRAG\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Desktop\VAMYDFPUND\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Desktop\SFPUSAFIOL\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Desktop\ONBQCLYSPU\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Desktop\KZWFNRXYKI\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Desktop\KATAXZVCPS\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Desktop\HTAGVDFUIE\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Desktop\DTBZGIOOSO\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Desktop\CURQNKVOIX\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Desktop\AIXACVYBSB\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\Contacts\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Skype\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Skype\RootTools\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\to-be-removed\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\temporary\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\security_state\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\minidumps\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\tmp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\events\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\bookmarkbackups\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending Pings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Extensions\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\f2eb6c79-671d-4de2-b7be-3b2eea7abc47\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\6d9d9777-7ded-4768-8191-9a707d72b009\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\61f56613-c62c-4b17-84dd-62b60d5776aa\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\56079431-ea46-4833-94f9-1ff5658cdb1c\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Sonar\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Sonar\SonarCC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\RTTransfer\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\LogTransport2CC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\LogTransport2\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Linguistics\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Headlights\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Flash Player\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Flash Player\NativeCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\CRLogs\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\CRLogs\crashlogs\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\Preflight Acrobat Continuous\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Forms\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Collab\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Linguistics\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cookie\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\VideoDecodeStats\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\d1702bdf-c0c8-42c3-b6d9-e52fd0a57b16\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\assets\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\DesktopNotification\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\DesktopNotification\NotificationsDB\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\VirtualStore\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\Symbols\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\mozilla-temp-files\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\Low\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\Diagnostics\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\SearchEmbdIndex\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\acrocef_low\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\DC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\SolidDocuments\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\SolidDocuments\Acrobat\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Publishers\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\SettingsContainer\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Microsoft.WindowsAlarms\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Licenses\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Fonts\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\PeerDistRepub\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\DiagOutputDir\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\BackgroundTransferApi\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\Flighting\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c58f7468-b990-418e-a4ba-ca3568b01c70}\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AC\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AC\Temp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txtJump to behavior

              Hooking and other Techniques for Hiding and Protection

              barindex
              Deletes itself after installation
              Source: C:\ProgramData\D448.tmpProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D448.tmp >> NUL
              Source: C:\ProgramData\D448.tmpProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D448.tmp >> NUL
              Uses an obfuscated file name to hide its real file extension (double extension)
              Source: Possible double extension: doc.scrStatic PE information: Document.doc.scr.exe
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BE91C8 RegCreateKeyExW,RegEnumKeyW,RegCreateKeyExW,RegSetValueExW,RegSetValueExW,OpenEventLogW,ClearEventLogW,CloseEventLog,RegCreateKeyExW,RegEnumKeyW,OpenEventLogW,ClearEventLogW,0_2_00BE91C8
              Source: C:\Users\user\Desktop\Document.doc.scr.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\ProgramData\D448.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
              Source: C:\ProgramData\D448.tmpProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\ProgramData\D448.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
              Source: C:\ProgramData\D448.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
              Source: C:\ProgramData\D448.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
              Source: C:\ProgramData\D448.tmpProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
              Source: C:\ProgramData\D448.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
              Source: C:\ProgramData\D448.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
              Source: C:\ProgramData\D448.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
              Source: C:\ProgramData\D448.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
              Source: C:\ProgramData\D448.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
              Source: C:\ProgramData\D448.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
              Source: C:\ProgramData\D448.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
              Source: C:\ProgramData\D448.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX

              Malware Analysis System Evasion

              barindex
              Contains functionality to detect hardware virtualization (CPUID execution measurement)
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BE10BC 0_2_00BE10BC
              Source: C:\ProgramData\D448.tmpCode function: 9_2_00401E28 9_2_00401E28
              Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
              Source: Document.doc.scr.exe, 00000000.00000003.1743563853.0000000001540000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\FIDDLER2\FIDDLER.EXE11126
              Source: Document.doc.scr.exe, 00000000.00000003.1743563853.0000000001540000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\WINDOWS KITS\10\DEBUGGERS\X64\WINDBG.EXE11179
              Source: Document.doc.scr.exe, 00000000.00000003.1743563853.0000000001540000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: {6D809377-6AF0-444B-8957-A3773F02200E}\SUPERANTISPYWARE\SUPERANTISPYWARE.EXE11328
              Source: Document.doc.scr.exe, 00000000.00000003.1743563853.0000000001540000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: {6D809377-6AF0-444B-8957-A3773F02200E}\WIRESHARK\WIRESHARK.EXE8327
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BE10BC rdtsc 0_2_00BE10BC
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BE74BC FindFirstFileExW,FindNextFileW,0_2_00BE74BC
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BEA094 FindFirstFileExW,FindClose,0_2_00BEA094
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BE5C24 FindFirstFileW,FindClose,FindNextFileW,FindClose,0_2_00BE5C24
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BE7590 FindFirstFileExW,0_2_00BE7590
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BE766C FindFirstFileExW,GetFileAttributesW,FindNextFileW,0_2_00BE766C
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BEF308 GetFileAttributesW,SetThreadPriority,FindFirstFileExW,FindNextFileW,FindClose,0_2_00BEF308
              Source: C:\ProgramData\D448.tmpCode function: 9_2_0040227C FindFirstFileExW,9_2_0040227C
              Source: C:\ProgramData\D448.tmpCode function: 9_2_0040152C FindFirstFileExW,FindClose,FindNextFileW,FindClose,9_2_0040152C
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BEA470 GetLogicalDriveStringsW,0_2_00BEA470
              Source: C:\Windows\splwow64.exeThread delayed: delay time: 120000
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\Jump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Local\Temp\Diagnostics\Jump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Jump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Jump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\Jump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\Jump to behavior
              Source: Document.doc.scr.exe, 00000000.00000003.1743563853.0000000001540000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: *|vmware workstation 15 player*|vmplayer6438
              Source: Document.doc.scr.exe, 00000000.00000003.1683665894.0000000001520000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 10/04/2023 10:58:22.220EXCEL (0x18B4)0x88CMicrosoft ExcelTelemetry Eventb7vzqMediumSendEvent {"EventName":"Office.System.SystemHealthMetadataDeviceConsolidated","Flags":33777031581908737,"InternalSequenceNumber":111,"Time":"2023-10-04T10:58:21.709Z","Rule":"120600.4","Contract":"Office.Legacy.Metadata","Data.ProcTypeText":"x64","Data.ProcessorCount":2,"Data.NumProcShareSingleCore":1,"Data.NumProcShareSingleCache":1,"Data.NumProcPhysCores":2,"Data.ProcSpeedMHz":2000,"Data.IsLaptop":false,"Data.IsTablet":false,"Data.RamMB":4096,"Data.PowerPlatformRole":1,"Data.SysVolSizeMB":50000,"Data.DeviceManufacturer":"VMWare, Inc.","Data.DeviceModel":"VMware20,1","Data.DigitizerInfo":0,"Data.SusClientId":"097C77FB-5D5D-4868-860B-09F4E5B50A53","Data.WindowsSqmMachineId":"92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A","Data.ComputerSystemProductUuidHash":"rC2kkStHpWGLvfAgmQZRz4w5ixE=","Data.DeviceProcessorModel":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","Data.HasSpectreFix":true,"Data.BootDiskType":"SSD"}
              Source: Document.doc.scr.exe, 00000000.00000003.1677426803.000000000159B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.
              Source: Document.doc.scr.exe, 00000000.00000003.1674503550.0000000001488000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 10/03/2023 13:09:52.535OFFICECL (0x2394)0x12d8Telemetry EventbiyhqMediumSendEvent {"EventName": "Office.System.SystemHealthMetadataDeviceConsolidated", "Flags": 33777031581908737, "InternalSequenceNumber": 11, "Time": "2023-10-03T12:09:52Z", "Rule": "120600.4", "AriaTenantToken": "cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521", "Contract": "Office.Legacy.Metadata", "Data.ProcTypeText": "x64", "Data.ProcessorCount": 2, "Data.NumProcShareSingleCore": 1, "Data.NumProcShareSingleCache": 1, "Data.NumProcPhysCores": 2, "Data.ProcSpeedMHz": 2000, "Data.IsLaptop": false, "Data.IsTablet": false, "Data.RamMB": 4096, "Data.PowerPlatformRole": 1, "Data.SysVolSizeMB": 50000, "Data.DeviceManufacturer": "VMWare, Inc.", "Data.DeviceModel": "VMware20,1", "Data.DigitizerInfo": 0, "Data.SusClientId": "097C77FB-5D5D-4868-860B-09F4E5B50A53", "Data.WindowsSqmMachineId": "92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A", "Data.ComputerSystemProductUuidHash": "rC2kkStHpWGLvfAgmQZRz4w5ixE=", "Data.DeviceProcessorModel": "Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz", "Data.HasSpectreFix": true, "Data.BootDiskType": "SSD"}
              Source: Settings.index.jC7CNxlVt.0.drBinary or memory string: hyper-v
              Source: Document.doc.scr.exe, 00000000.00000003.1743563853.0000000001540000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: *|*|qemu10642
              Source: Document.doc.scr.exe, 00000000.00000003.1743563853.0000000001540000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: {6D809377-6AF0-444B-8957-A3773F02200E}\Hyper-V\VMCreate.exe10779
              Source: Document.doc.scr.exe, 00000000.00000003.1683665894.0000000001520000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 10/04/2023 10:58:38.204EXCEL (0x1F28)0x1DB0Microsoft ExcelTelemetry Eventb7vzqMediumSendEvent {"EventName":"Office.System.SystemHealthMetadataDeviceConsolidated","Flags":33777031581908737,"InternalSequenceNumber":92,"Time":"2023-10-04T10:58:38.014Z","Rule":"120600.4","Contract":"Office.Legacy.Metadata","Data.ProcTypeText":"x64","Data.ProcessorCount":2,"Data.NumProcShareSingleCore":1,"Data.NumProcShareSingleCache":1,"Data.NumProcPhysCores":2,"Data.ProcSpeedMHz":2000,"Data.IsLaptop":false,"Data.IsTablet":false,"Data.RamMB":4096,"Data.PowerPlatformRole":1,"Data.SysVolSizeMB":50000,"Data.DeviceManufacturer":"VMWare, Inc.","Data.DeviceModel":"VMware20,1","Data.DigitizerInfo":0,"Data.SusClientId":"097C77FB-5D5D-4868-860B-09F4E5B50A53","Data.WindowsSqmMachineId":"92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A","Data.ComputerSystemProductUuidHash":"rC2kkStHpWGLvfAgmQZRz4w5ixE=","Data.DeviceProcessorModel":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","Data.HasSpectreFix":true,"Data.BootDiskType":"SSD"}
              Source: Settings.index.jC7CNxlVt.0.drBinary or memory string: hyper-vOs and f
              Source: Document.doc.scr.exe, 00000000.00000003.1743563853.0000000001540000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware.Workstation.vmui7769
              Source: Document.doc.scr.exe, 00000000.00000003.1743563853.0000000001540000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware.Workstation.vmplayer8211
              Source: Document.doc.scr.exe, 00000000.00000003.1743563853.0000000001540000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe8601
              Source: Document.doc.scr.exe, 00000000.00000003.1939350231.0000000001404000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000002.2101878302.0000000001403000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.2091177762.0000000001403000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1933272646.0000000001404000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
              Source: Document.doc.scr.exe, 00000000.00000003.1625531147.0000000001419000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
              Source: Document.doc.scr.exe, 00000000.00000003.1743563853.0000000001540000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: *|vmware horizon client*|vm ware8394
              Source: Document.doc.scr.exe, 00000000.00000003.1743563853.0000000001540000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: *|vmware vsphere client*|vspe6388
              Source: Document.doc.scr.exe, 00000000.00000003.1743563853.0000000001540000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: *|vmware horizon client*|vdi3894
              Source: Document.doc.scr.exe, 00000000.00000003.1887493807.00000000015A4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware20,1
              Source: Document.doc.scr.exe, 00000000.00000003.1743563853.0000000001540000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: *|vmware horizon client*|view5503
              Source: Document.doc.scr.exe, 00000000.00000003.1743563853.0000000001540000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: *|vmware workstation 12 player*|vmpl5459
              Source: Document.doc.scr.exe, 00000000.00000003.1743563853.0000000001540000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: *|*|vmware6886
              Source: Document.doc.scr.exe, 00000000.00000003.1743563853.0000000001540000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: *|vmware vsphere client*|vcenter5038
              Source: Document.doc.scr.exe, 00000000.00000003.1743563853.0000000001540000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: *|vmware horizon client*|vmare7220
              Source: Document.doc.scr.exe, 00000000.00000003.1743563853.0000000001540000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware.Horizon.Client8097
              Source: C:\Users\user\Desktop\Document.doc.scr.exeProcess information queried: ProcessInformation

              Anti Debugging

              barindex
              Hides threads from debuggers
              Source: C:\Users\user\Desktop\Document.doc.scr.exeThread information set: HideFromDebuggerJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeThread information set: HideFromDebuggerJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeThread information set: HideFromDebuggerJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeThread information set: HideFromDebuggerJump to behavior
              Source: C:\ProgramData\D448.tmpThread information set: HideFromDebugger
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BE10BC rdtsc 0_2_00BE10BC
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BE5A20 LdrLoadDll,0_2_00BE5A20
              Source: C:\Users\user\Desktop\Document.doc.scr.exeProcess token adjusted: Debug
              Source: C:\Users\user\Desktop\Document.doc.scr.exeProcess token adjusted: Debug
              Source: C:\Users\user\Desktop\Document.doc.scr.exeProcess token adjusted: Debug

              HIPS / PFW / Operating System Protection Evasion

              barindex
              Writes to foreign memory regions
              Source: C:\Users\user\Desktop\Document.doc.scr.exeMemory written: C:\ProgramData\D448.tmp base: 401000Jump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeProcess created: C:\ProgramData\D448.tmp "C:\ProgramData\D448.tmp"Jump to behavior
              Source: C:\ProgramData\D448.tmpProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D448.tmp >> NUL
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BE10BC cpuid 0_2_00BE10BC
              Source: C:\ProgramData\D448.tmpCode function: EntryPoint,ExitProcess,GetModuleHandleW,GetCommandLineW,GetModuleHandleA,GetCommandLineW,GetLocaleInfoW,GetLastError,FreeLibrary,FreeLibrary,GetProcAddress,CreateWindowExW,DefWindowProcW,GetWindowTextW,LoadMenuW,LoadMenuW,DefWindowProcW,SetTextColor,GetTextCharset,TextOutW,SetTextColor,GetTextColor,CreateFontW,GetTextColor,CreateDIBitmap,SelectObject,GetTextColor,CreateFontW,9_2_00403983
              Source: C:\Users\user\Desktop\Document.doc.scr.exeCode function: 0_2_00BF04B4 GetTempFileNameW,CreateFileW,WriteFile,CreateProcessW,NtQueryInformationProcess,NtReadVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,CreateNamedPipeW,ResumeThread,ConnectNamedPipe,0_2_00BF04B4

              Lowering of HIPS / PFW / Operating System Security Settings

              barindex
              Overwrites Mozilla Firefox settings
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\to-be-removed\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\temporary\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\security_state\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\minidumps\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\tmp\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\events\jC7CNxlVt.README.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\bookmarkbackups\jC7CNxlVt.README.txtJump to behavior

              Stealing of Sensitive Information

              barindex
              Tries to harvest and steal browser information (history, passwords, etc)
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829702.cde8135c-88c3-4c34-8670-7ef017742548.new-profile.jsonlz4Jump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\background-updateJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\a5d6ec76-765c-4778-afd2-1e05a1554d8e.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834620.c7889da7-33f0-4599-8452-58d47c58437b.main.jsonlz4Jump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shmJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.jsJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqliteJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\pkcs11.txt.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shmJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829744.7278f154-e8f4-4235-84c5-c5c1c6af0084.main.jsonlz4Jump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\6fc53411-ad83-4cf6-a5f6-905f0f3f52e8.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\1435a377-bbaf-4c9c-8706-0811a779fa3fJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\.metadata-v2Jump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\.metadata-v2.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqliteJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\808127e8-e7ed-4078-b3f3-7f09061a011fJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\times.jsonJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqliteJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.dbJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\search.json.mozlz4.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\previous.jsonlz4.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\times.json.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqliteJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\shield-preference-experiments.json.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\xulstore.json.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqliteJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857860.81ddb4cc-1d49-45f2-961f-e24ea6db2be5.health.jsonlz4Jump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shmJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.ini.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\Telemetry.FailedProfileLocks.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\12f997af-c065-4562-b9f6-11000bb95c9bJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\277ffbb3-8e94-4f3f-acac-7a401d130160.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\xulstore.jsonJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\1d5599c8-3f43-42cc-8163-9a43c60a06d1Jump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834580.6fc53411-ad83-4cf6-a5f6-905f0f3f52e8.health.jsonlz4Jump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqliteJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore.jsonlz4.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\state.json.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.iniJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829744.7278f154-e8f4-4235-84c5-c5c1c6af0084.main.jsonlz4.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shmJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\handlers.json.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829746.67aa4432-87f8-463e-b422-f6679add9971.first-shutdown.jsonlz4.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\pkcs11.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqliteJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\7278f154-e8f4-4235-84c5-c5c1c6af0084.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\78267ebf-1fb3-4b11-82e9-903e54a2a54eJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\45e26519-596d-41a5-b290-e547b44111fd.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829702.cde8135c-88c3-4c34-8670-7ef017742548.new-profile.jsonlz4.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4Jump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqliteJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\times.jsonJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\6fc53411-ad83-4cf6-a5f6-905f0f3f52e8Jump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829746.67aa4432-87f8-463e-b422-f6679add9971.first-shutdown.jsonlz4Jump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\05d02ac8-b2f1-4670-8541-db8ec2bbf427.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\1435a377-bbaf-4c9c-8706-0811a779fa3f.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\7278f154-e8f4-4235-84c5-c5c1c6af0084Jump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.jsonJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\45e26519-596d-41a5-b290-e547b44111fdJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\Telemetry.FailedProfileLocks.txt.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.dbJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shmJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\a5d6ec76-765c-4778-afd2-1e05a1554d8eJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\background-update.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857860.81ddb4cc-1d49-45f2-961f-e24ea6db2be5.health.jsonlz4.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\SiteSecurityServiceState.txt.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\handlers.jsonJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\3a40aaf9-3f8b-43a2-85e8-88e3ffc7666f.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\AlternateServices.txt.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\7d12ac42-15c3-4db9-abfe-259bc8d249acJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\containers.json.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\shield-preference-experiments.jsonJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\15f01145-7764-450b-9ad5-323693350a9cJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\previous.jsonlz4Jump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.jsonJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqliteJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857869.95af30ae-acac-4802-b983-233d7fd3cf34.main.jsonlz4.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857833.45e26519-596d-41a5-b290-e547b44111fd.health.jsonlz4Jump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore.jsonlz4Jump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shmJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-shmJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqliteJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\state.jsonJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857860.a73949a2-5a70-4025-8008-88156c16bb4a.event.jsonlz4Jump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\a7174184-f177-48c4-876a-8a51c2ed8fbcJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829737.9f7a5e7a-2be0-4ff7-b132-b1f6e59a8e58.event.jsonlz4Jump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834606.011115ff-9301-40fc-805e-ba07b7fdfce4.event.jsonlz4.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\808127e8-e7ed-4078-b3f3-7f09061a011f.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834608.65054280-9d54-477d-a3ea-afcb1f88e001.health.jsonlz4Jump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.jsonJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\containers.jsonJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\eventsJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqliteJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extension-preferences.json.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqliteJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\session-state.jsonJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\05d02ac8-b2f1-4670-8541-db8ec2bbf427Jump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\7d12ac42-15c3-4db9-abfe-259bc8d249ac.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857869.95af30ae-acac-4802-b983-233d7fd3cf34.main.jsonlz4Jump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shmJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\events.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\session-state.json.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834580.6fc53411-ad83-4cf6-a5f6-905f0f3f52e8.health.jsonlz4.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extension-preferences.jsonJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\times.json.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\15f01145-7764-450b-9ad5-323693350a9c.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\AlternateServices.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857860.a73949a2-5a70-4025-8008-88156c16bb4a.event.jsonlz4.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\3a40aaf9-3f8b-43a2-85e8-88e3ffc7666fJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqliteJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\1d5599c8-3f43-42cc-8163-9a43c60a06d1.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\SiteSecurityServiceState.txtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\12f997af-c065-4562-b9f6-11000bb95c9b.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528Jump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834620.c7889da7-33f0-4599-8452-58d47c58437b.main.jsonlz4.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.jsonJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-shm.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\search.json.mozlz4Jump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqliteJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829737.9f7a5e7a-2be0-4ff7-b132-b1f6e59a8e58.event.jsonlz4.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqliteJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857833.45e26519-596d-41a5-b290-e547b44111fd.health.jsonlz4.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834608.65054280-9d54-477d-a3ea-afcb1f88e001.health.jsonlz4.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shmJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\277ffbb3-8e94-4f3f-acac-7a401d130160Jump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\a7174184-f177-48c4-876a-8a51c2ed8fbc.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\78267ebf-1fb3-4b11-82e9-903e54a2a54e.jC7CNxlVtJump to behavior
              Source: C:\Users\user\Desktop\Document.doc.scr.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834606.011115ff-9301-40fc-805e-ba07b7fdfce4.event.jsonlz4Jump to behavior

              Mitre Att&ck Matrix

              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
              Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
              DLL Side-Loading              		112
              Process Injection              		111
              Masquerading              		1
              OS Credential Dumping              		311
              Security Software Discovery              		Remote Services1
              Archive Collected Data              		1
              Encrypted Channel              		Exfiltration Over Other Network Medium1
              Data Encrypted for Impact
              CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
              DLL Side-Loading              		11
              Virtualization/Sandbox Evasion              		LSASS Memory1
              Process Discovery              		Remote Desktop Protocol1
              Browser Session Hijacking              		1
              Proxy              		Exfiltration Over BluetoothNetwork Denial of Service
              Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)112
              Process Injection              		Security Account Manager11
              Virtualization/Sandbox Evasion              		SMB/Windows Admin Shares1
              Data from Local System              		SteganographyAutomated ExfiltrationData Encrypted for Impact
              Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook11
              Obfuscated Files or Information              		NTDS5
              File and Directory Discovery              		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
              Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
              Indicator Removal              		LSA Secrets122
              System Information Discovery              		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
              Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
              DLL Side-Loading              		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
              DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
              File Deletion              		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet
              behaviorgraph top1 signatures2 2 Behavior Graph ID: 1432010 Sample: Document.doc.scr.exe Startdate: 26/04/2024 Architecture: WINDOWS Score: 100 40 Multi AV Scanner detection for domain / URL 2->40 42 Malicious sample detected (through community Yara rule) 2->42 44 Antivirus detection for URL or domain 2->44 46 9 other signatures 2->46 8 Document.doc.scr.exe 32 1002 2->8         started        12 ONENOTE.EXE 2->12         started        process3 file4 24 C:\Users\user\...\xulstore.json.jC7CNxlVt, data 8->24 dropped 26 C:\Users\...\webappsstore.sqlite.jC7CNxlVt, data 8->26 dropped 28 C:\...\webappsstore.sqlite-shm.jC7CNxlVt, data 8->28 dropped 30 265 other files (261 malicious) 8->30 dropped 48 Found potential ransomware demand text 8->48 50 Found Tor onion address 8->50 52 Contains functionality to detect hardware virtualization (CPUID execution measurement) 8->52 54 8 other signatures 8->54 14 D448.tmp 8->14         started        18 splwow64.exe 8->18         started        signatures5 process6 file7 32 C:\Users\user\...\ZZZZZZZZZZZZZZZZZZZZ (copy), data 14->32 dropped 34 C:\Users\user\...\YYYYYYYYYYYYYYYYYYYY (copy), data 14->34 dropped 36 C:\Users\user\...\XXXXXXXXXXXXXXXXXXXX (copy), data 14->36 dropped 38 24 other malicious files 14->38 dropped 56 Contains functionality to detect hardware virtualization (CPUID execution measurement) 14->56 58 Writes many files with high entropy 14->58 60 Hides threads from debuggers 14->60 62 Deletes itself after installation 14->62 20 cmd.exe 14->20         started        signatures8 process9 process10 22 conhost.exe 20->22         started       

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


              windows-stand

              Antivirus, Machine Learning and Genetic Malware Detection

              Initial Sample

              SourceDetectionScannerLabelLink
              Document.doc.scr.exe87%ReversingLabsWin32.Ransomware.Lockbit
              Document.doc.scr.exe86%VirustotalBrowse
              Document.doc.scr.exe100%AviraBDS/ZeroAccess.Gen7
              Document.doc.scr.exe100%Joe Sandbox ML

              Dropped Files

              ⊘No Antivirus matches

              Unpacked PE Files

              ⊘No Antivirus matches

              Domains

              ⊘No Antivirus matches

              URLs

              SourceDetectionScannerLabelLink
              https://cdn.entity.0%URL Reputationsafe
              https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
              https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
              https://api.aadrm.com/0%URL Reputationsafe
              https://api.aadrm.com/0%URL Reputationsafe
              https://messagebroker.mobile.m365.svc.cloud.microsoft0%URL Reputationsafe
              https://otelrules.svc.static.microsoft0%URL Reputationsafe
              https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
              https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
              https://officeci.azurewebsites.net/api/0%URL Reputationsafe
              https://my.microsoftpersonalcontent.com0%URL Reputationsafe
              https://store.office.cn/addinstemplate0%URL Reputationsafe
              https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta0%URL Reputationsafe
              https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta0%URL Reputationsafe
              https://www.odwebp.svc.ms0%URL Reputationsafe
              https://api.addins.store.officeppe.com/addinstemplate0%URL Reputationsafe
              https://bugzilla.mo0%URL Reputationsafe
              https://ncus.contentsync.0%URL Reputationsafe
              https://wus2.contentsync.0%URL Reputationsafe
              https://wus2.contentsync.0%URL Reputationsafe
              https://account.bellmedia.c0%URL Reputationsafe
              https://skyapi.live.net/Activity/0%URL Reputationsafe
              https://skyapi.live.net/Activity/0%URL Reputationsafe
              https://api.cortana.ai0%URL Reputationsafe
              https://www.amazon.co.uk/0%URL Reputationsafe
              https://www.amazon.co.uk/0%URL Reputationsafe
              https://staging.cortana.ai0%URL Reputationsafe
              https://wus2.pagecontentsync.0%URL Reputationsafe
              http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionug0%Avira URL Cloudsafe
              https://d.docs.live.net0%Avira URL Cloudsafe
              https://www.bbc.co.uk/0%Avira URL Cloudsafe
              http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion100%Avira URL Cloudmalware
              http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionJK0%Avira URL Cloudsafe
              http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion.Jr=0%Avira URL Cloudsafe
              http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionlWJ0%Avira URL Cloudsafe
              https://www.bbc.co.uk/0%VirustotalBrowse
              https://d.docs.live.net0%VirustotalBrowse
              http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion13%VirustotalBrowse

              Domains and IPs

              Contacted Domains

              ⊘No contacted domains info

              URLs from Memory and Binaries

              NameSourceMaliciousAntivirus DetectionReputation
              https://shell.suite.office.com:144380E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                		high
                https://autodiscover-s.outlook.com/80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                  		high
                  https://useraudit.o365auditrealtimeingestion.manage.office.com80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                    		high
                    https://firefox.settings.services.mozilla.com/v1/Document.doc.scr.exe, 00000000.00000003.1878035842.0000000001522000.00000004.00000020.00020000.00000000.sdmpfalse
                      		high
                      https://outlook.office365.com/connectors80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                        		high
                        https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                          		high
                          https://cdn.entity.80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                          • URL Reputation: safe
                          		unknown
                          https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.Document.doc.scr.exe, 00000000.00000003.1641926636.00000000014C2000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                              		high
                              https://rpsticket.partnerservices.getmicrosoftkey.com80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              https://lookup.onenote.com/lookup/geolocation/v180E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                		high
                                https://www.leboncoin.fr/Document.doc.scr.exe, 00000000.00000003.1645091771.00000000014D5000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                    		high
                                    https://api.aadrm.com/80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    https://www.yammer.com80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                      		high
                                      https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                        		high
                                        https://api.microsoftstream.com/api/80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                          		high
                                          https://insertmedia.bing.office.net/images/hosted?host=office&amp;adlt=strict&amp;hostType=Immersive80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                            		high
                                            https://www.msn.comDocument.doc.scr.exe, 00000000.00000003.1877029171.0000000001526000.00000004.00000020.00020000.00000000.sdmp, 3870112724rsegmnoittet-es.sqlite.jC7CNxlVt.0.drfalse
                                              		high
                                              https://cr.office.com80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                		high
                                                https://messagebroker.mobile.m365.svc.cloud.microsoft80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                • URL Reputation: safe
                                                		unknown
                                                https://otelrules.svc.static.microsoft80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                • URL Reputation: safe
                                                		unknown
                                                http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionugDocument.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmptrue
                                                • Avira URL Cloud: safe
                                                		unknown
                                                https://edge.skype.com/registrar/prod80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                  		high
                                                  https://res.getmicrosoftkey.com/api/redemptionevents80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  		unknown
                                                  https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94Document.doc.scr.exe, 00000000.00000003.1641926636.00000000014C2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://tasks.office.com80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                      		high
                                                      https://officeci.azurewebsites.net/api/80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                      • URL Reputation: safe
                                                      		unknown
                                                      https://my.microsoftpersonalcontent.com80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                      • URL Reputation: safe
                                                      		unknown
                                                      https://store.office.cn/addinstemplate80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                      • URL Reputation: safe
                                                      		unknown
                                                      http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionDocument.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmptrue
                                                      • 13%, Virustotal, Browse
                                                      • Avira URL Cloud: malware
                                                      		unknown
                                                      https://edge.skype.com/rps80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                        		high
                                                        https://messaging.engagement.office.com/80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                          		high
                                                          https://www.amazon.com/Document.doc.scr.exe, 00000000.00000003.1645091771.00000000014D5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                              		high
                                                              https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&ctaDocument.doc.scr.exe, 00000000.00000003.1641926636.00000000014C2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              		unknown
                                                              https://www.odwebp.svc.ms80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                              • URL Reputation: safe
                                                              		unknown
                                                              https://api.powerbi.com/v1.0/myorg/groups80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                		high
                                                                https://web.microsoftstream.com/video/80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                  		high
                                                                  https://api.addins.store.officeppe.com/addinstemplate80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                  • URL Reputation: safe
                                                                  		unknown
                                                                  https://graph.windows.net80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                    		high
                                                                    https://MD8.mozilla.org/1/mDocument.doc.scr.exe, 00000000.00000003.1646091627.00000000014D5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://www.bbc.co.uk/Document.doc.scr.exe, 00000000.00000003.1645091771.00000000014D5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      • 0%, Virustotal, Browse
                                                                      • Avira URL Cloud: safe
                                                                      		unknown
                                                                      https://bugzilla.moDocument.doc.scr.exe, 00000000.00000003.1645091771.00000000014D5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      • URL Reputation: safe
                                                                      		unknown
                                                                      https://consent.config.office.com/consentcheckin/v1.0/consents80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                        		high
                                                                        https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                          		high
                                                                          https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                            		high
                                                                            https://d.docs.live.net80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                            • 0%, Virustotal, Browse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://safelinks.protection.outlook.com/api/GetPolicy80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                              		high
                                                                              https://ncus.contentsync.80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                              • URL Reputation: safe
                                                                              		unknown
                                                                              https://firefox-settings-attachments.cdn.mozilla.net/Document.doc.scr.exe, 00000000.00000003.1878035842.0000000001522000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                                  		high
                                                                                  http://weather.service.msn.com/data.aspx80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                                    		high
                                                                                    https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                                      		high
                                                                                      https://www.iqiyi.com/Document.doc.scr.exe, 00000000.00000003.1645091771.00000000014D5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                                          		high
                                                                                          https://pushchannel.1drv.ms80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                                            		high
                                                                                            https://wus2.contentsync.80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                                            • URL Reputation: safe
                                                                                            • URL Reputation: safe
                                                                                            		unknown
                                                                                            https://clients.config.office.net/user/v1.0/ios80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                                              		high
                                                                                              https://api.addins.omex.office.net/api/addins/search80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                                                		high
                                                                                                https://outlook.office365.com/api/v1.0/me/Activities80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                                                  		high
                                                                                                  https://clients.config.office.net/user/v1.0/android/policies80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                                                    		high
                                                                                                    https://entitlement.diagnostics.office.com80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                                                      		high
                                                                                                      https://www.tsn.caDocument.doc.scr.exe, 00000000.00000003.1877029171.0000000001526000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                                                          		high
                                                                                                          https://outlook.office.com/80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                                                            		high
                                                                                                            https://storage.live.com/clientlogs/uploadlocation80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                                                              		high
                                                                                                              https://account.bellmedia.c3870112724rsegmnoittet-es.sqlite.jC7CNxlVt.0.drfalse
                                                                                                              • URL Reputation: safe
                                                                                                              		unknown
                                                                                                              https://login.microsoftonline.comDocument.doc.scr.exe, 00000000.00000003.1877029171.0000000001526000.00000004.00000020.00020000.00000000.sdmp, 3870112724rsegmnoittet-es.sqlite.jC7CNxlVt.0.dr, 80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                                                                		high
                                                                                                                https://substrate.office.com/search/api/v1/SearchHistory80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                                                                  		high
                                                                                                                  https://www.zhihu.com/Document.doc.scr.exe, 00000000.00000003.1645091771.00000000014DF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://clients.config.office.net/c2r/v1.0/InteractiveInstallation80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                                                                      		high
                                                                                                                      https://graph.windows.net/80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                                                                        		high
                                                                                                                        https://devnull.onenote.com80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                                                                          		high
                                                                                                                          https://messaging.office.com/80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                                                                            		high
                                                                                                                            https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                                                                              		high
                                                                                                                              https://skyapi.live.net/Activity/80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                                                                              • URL Reputation: safe
                                                                                                                              • URL Reputation: safe
                                                                                                                              		unknown
                                                                                                                              https://api.cortana.ai80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                                                                              • URL Reputation: safe
                                                                                                                              		unknown
                                                                                                                              https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpgDocument.doc.scr.exe, 00000000.00000003.1641926636.00000000014C2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                https://www.amazon.co.uk/Document.doc.scr.exe, 00000000.00000003.1645091771.00000000014D5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                • URL Reputation: safe
                                                                                                                                • URL Reputation: safe
                                                                                                                                		unknown
                                                                                                                                https://messaging.action.office.com/setcampaignaction80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                                                                                  		high
                                                                                                                                  https://visio.uservoice.com/forums/368202-visio-on-devices80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                                                                                    		high
                                                                                                                                    http://kinto.readthedocs.io/en/latest/tutorials/synchronisation.html#polling-for-remote-changesDocument.doc.scr.exe, 00000000.00000003.1878035842.0000000001522000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionJKDocument.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                      • Avira URL Cloud: safe
                                                                                                                                      		unknown
                                                                                                                                      https://staging.cortana.ai80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                                                                                      • URL Reputation: safe
                                                                                                                                      		unknown
                                                                                                                                      https://onedrive.live.com/embed?80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                                                                                        		high
                                                                                                                                        https://augloop.office.com80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                                                                                          		high
                                                                                                                                          https://www.wykop.pl/Document.doc.scr.exe, 00000000.00000003.1645091771.00000000014D5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            https://www.olx.pl/Document.doc.scr.exe, 00000000.00000003.1645091771.00000000014DF000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr.exe, 00000000.00000003.1645091771.00000000014D5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              https://api.diagnosticssdf.office.com/v2/file80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                                                                                                		high
                                                                                                                                                https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                                                                                                  		high
                                                                                                                                                  https://officepyservice.office.net/80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                                                                                                    		high
                                                                                                                                                    http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion.Jr=Document.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                    • Avira URL Cloud: safe
                                                                                                                                                    		low
                                                                                                                                                    https://api.diagnostics.office.com80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                                                                                                      		high
                                                                                                                                                      http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionlWJDocument.doc.scr.exe, 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                      • Avira URL Cloud: safe
                                                                                                                                                      		unknown
                                                                                                                                                      https://github.com/Kinto/kinto-attachment/Document.doc.scr.exe, 00000000.00000003.1878035842.0000000001522000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        https://store.office.de/addinstemplate80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                                                                                                          		high
                                                                                                                                                          https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpgDocument.doc.scr.exe, 00000000.00000003.1641926636.00000000014C2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            https://wus2.pagecontentsync.80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                                                                                                            • URL Reputation: safe
                                                                                                                                                            		unknown
                                                                                                                                                            https://api.powerbi.com/v1.0/myorg/datasets80E5AD7B-B7F0-4875-BF29-ED264BCAFC67.8.drfalse
                                                                                                                                                              		high

                                                                                                                                                              World Map of Contacted IPs

                                                                                                                                                              ⊘No contacted IP infos

                                                                                                                                                              General Information

                                                                                                                                                              Joe Sandbox version:40.0.0 Tourmaline
                                                                                                                                                              Analysis ID:1432010
                                                                                                                                                              Start date and time:2024-04-26 09:15:05 +02:00
                                                                                                                                                              Joe Sandbox product:CloudBasic
                                                                                                                                                              Overall analysis duration:0h 7m 17s
                                                                                                                                                              Hypervisor based Inspection enabled:false
                                                                                                                                                              Report type:full
                                                                                                                                                              Cookbook file name:default.jbs
                                                                                                                                                              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                              Number of analysed new started processes analysed:17
                                                                                                                                                              Number of new started drivers analysed:0
                                                                                                                                                              Number of existing processes analysed:0
                                                                                                                                                              Number of existing drivers analysed:0
                                                                                                                                                              Number of injected processes analysed:0
                                                                                                                                                              Technologies:
                                                                                                                                                              • HCA enabled
                                                                                                                                                              • EGA enabled
                                                                                                                                                              • AMSI enabled
                                                                                                                                                              Analysis Mode:default
                                                                                                                                                              Analysis stop reason:Timeout
                                                                                                                                                              Sample name:Document.doc.scr.exe
                                                                                                                                                              Detection:MAL
                                                                                                                                                              Classification:mal100.rans.phis.spyw.evad.winEXE@9/1664@0/0
                                                                                                                                                              EGA Information:
                                                                                                                                                              • Successful, ratio: 100%
                                                                                                                                                              HCA Information:
                                                                                                                                                              • Successful, ratio: 100%
                                                                                                                                                              • Number of executed functions: 84
                                                                                                                                                              • Number of non-executed functions: 6
                                                                                                                                                              Cookbook Comments:
                                                                                                                                                              • Found application associated with file extension: .exe

                                                                                                                                                              Warnings

                                                                                                                                                              • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, printfilterpipelinesvc.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
                                                                                                                                                              • Excluded IPs from analysis (whitelisted): 52.109.0.91, 52.109.8.36, 52.113.194.132, 23.213.224.106, 52.182.143.214
                                                                                                                                                              • Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, osiprod-cus-buff-azsc-000.centralus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, wus-azsc-config.officeapps.live.com, officeclient.microsoft.com, prod.fs.microsoft.com.akadns.net, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, cus-azsc-000.roaming.officeapps.live.com, fe3cr.delivery.mp.microsoft.com, us1.roaming1.live.com.akadns.net, s-0005.s-msedge.net, config.officeapps.live.com, us.configsvc1.live.com.akadns.net, onedscolprdcus19.centralus.cloudapp.azure.com, ecs.office.trafficmanager.net
                                                                                                                                                              • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                              • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                              • Report size getting too big, too many NtCreateFile calls found.
                                                                                                                                                              • Report size getting too big, too many NtCreateKey calls found.
                                                                                                                                                              • Report size getting too big, too many NtDeviceIoControlFile calls found.
                                                                                                                                                              • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                                                              • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                                                              • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                              • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                                                                                                                              • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                              • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                                                              • Report size getting too big, too many NtReadFile calls found.
                                                                                                                                                              • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                                              • Report size getting too big, too many NtWriteFile calls found.

                                                                                                                                                              Simulations

                                                                                                                                                              Behavior and APIs

                                                                                                                                                              TimeTypeDescription
                                                                                                                                                              09:16:28API Interceptor97x Sleep call for process: splwow64.exe modified

                                                                                                                                                              Joe Sandbox View / Context

                                                                                                                                                              IPs

                                                                                                                                                              ⊘No context

                                                                                                                                                              Domains

                                                                                                                                                              ⊘No context

                                                                                                                                                              ASNs

                                                                                                                                                              ⊘No context

                                                                                                                                                              JA3 Fingerprints

                                                                                                                                                              ⊘No context

                                                                                                                                                              Dropped Files

                                                                                                                                                              ⊘No context

                                                                                                                                                              Created / dropped Files

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\AAAAAAAAAAA (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.5285554530473515
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:DvKOnan8bIswbr/dvGQ1Im/MPLSyJVzE7+col:+IanmIP1hKmyJtjl
                                                                                                                                                              MD5:A09443444F33169624379B9D51FC6488
                                                                                                                                                              SHA1:D29BDEC3E34278C4A36C5B8DC9AEDF6A92C8F160
                                                                                                                                                              SHA-256:32F15D73E7781E8D68CBD4D3DF1BA445FFC8A693AADE300CEA98EF942BA404FC
                                                                                                                                                              SHA-512:0C990D2EABBC202BCEB363259F2BE2B68CA51C9784D48C330677E5ABC1DDBC3F44CC1F946E1771845AEC0380080BEF8B249C7B0A8A997C229F29808166012836
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:low
                                                                                                                                                              Preview:P.t..Hp.y.U.H...J....8..=..|^.F..O..D.K.......Jv.o......U6.1..,`D...~.Y/.Pe.'-.1i....`Se.....8....*....I.^.r...$..!..9...

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\BBBBBBBBBBB (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.5285554530473515
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:DvKOnan8bIswbr/dvGQ1Im/MPLSyJVzE7+col:+IanmIP1hKmyJtjl
                                                                                                                                                              MD5:A09443444F33169624379B9D51FC6488
                                                                                                                                                              SHA1:D29BDEC3E34278C4A36C5B8DC9AEDF6A92C8F160
                                                                                                                                                              SHA-256:32F15D73E7781E8D68CBD4D3DF1BA445FFC8A693AADE300CEA98EF942BA404FC
                                                                                                                                                              SHA-512:0C990D2EABBC202BCEB363259F2BE2B68CA51C9784D48C330677E5ABC1DDBC3F44CC1F946E1771845AEC0380080BEF8B249C7B0A8A997C229F29808166012836
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:low
                                                                                                                                                              Preview:P.t..Hp.y.U.H...J....8..=..|^.F..O..D.K.......Jv.o......U6.1..,`D...~.Y/.Pe.'-.1i....`Se.....8....*....I.^.r...$..!..9...

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\CCCCCCCCCCC (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.5285554530473515
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:DvKOnan8bIswbr/dvGQ1Im/MPLSyJVzE7+col:+IanmIP1hKmyJtjl
                                                                                                                                                              MD5:A09443444F33169624379B9D51FC6488
                                                                                                                                                              SHA1:D29BDEC3E34278C4A36C5B8DC9AEDF6A92C8F160
                                                                                                                                                              SHA-256:32F15D73E7781E8D68CBD4D3DF1BA445FFC8A693AADE300CEA98EF942BA404FC
                                                                                                                                                              SHA-512:0C990D2EABBC202BCEB363259F2BE2B68CA51C9784D48C330677E5ABC1DDBC3F44CC1F946E1771845AEC0380080BEF8B249C7B0A8A997C229F29808166012836
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:low
                                                                                                                                                              Preview:P.t..Hp.y.U.H...J....8..=..|^.F..O..D.K.......Jv.o......U6.1..,`D...~.Y/.Pe.'-.1i....`Se.....8....*....I.^.r...$..!..9...

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\DDDDDDDDDDD (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.5285554530473515
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:DvKOnan8bIswbr/dvGQ1Im/MPLSyJVzE7+col:+IanmIP1hKmyJtjl
                                                                                                                                                              MD5:A09443444F33169624379B9D51FC6488
                                                                                                                                                              SHA1:D29BDEC3E34278C4A36C5B8DC9AEDF6A92C8F160
                                                                                                                                                              SHA-256:32F15D73E7781E8D68CBD4D3DF1BA445FFC8A693AADE300CEA98EF942BA404FC
                                                                                                                                                              SHA-512:0C990D2EABBC202BCEB363259F2BE2B68CA51C9784D48C330677E5ABC1DDBC3F44CC1F946E1771845AEC0380080BEF8B249C7B0A8A997C229F29808166012836
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:low
                                                                                                                                                              Preview:P.t..Hp.y.U.H...J....8..=..|^.F..O..D.K.......Jv.o......U6.1..,`D...~.Y/.Pe.'-.1i....`Se.....8....*....I.^.r...$..!..9...

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\EEEEEEEEEEE (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.5285554530473515
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:DvKOnan8bIswbr/dvGQ1Im/MPLSyJVzE7+col:+IanmIP1hKmyJtjl
                                                                                                                                                              MD5:A09443444F33169624379B9D51FC6488
                                                                                                                                                              SHA1:D29BDEC3E34278C4A36C5B8DC9AEDF6A92C8F160
                                                                                                                                                              SHA-256:32F15D73E7781E8D68CBD4D3DF1BA445FFC8A693AADE300CEA98EF942BA404FC
                                                                                                                                                              SHA-512:0C990D2EABBC202BCEB363259F2BE2B68CA51C9784D48C330677E5ABC1DDBC3F44CC1F946E1771845AEC0380080BEF8B249C7B0A8A997C229F29808166012836
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:low
                                                                                                                                                              Preview:P.t..Hp.y.U.H...J....8..=..|^.F..O..D.K.......Jv.o......U6.1..,`D...~.Y/.Pe.'-.1i....`Se.....8....*....I.^.r...$..!..9...

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\FFFFFFFFFFF (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.5285554530473515
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:DvKOnan8bIswbr/dvGQ1Im/MPLSyJVzE7+col:+IanmIP1hKmyJtjl
                                                                                                                                                              MD5:A09443444F33169624379B9D51FC6488
                                                                                                                                                              SHA1:D29BDEC3E34278C4A36C5B8DC9AEDF6A92C8F160
                                                                                                                                                              SHA-256:32F15D73E7781E8D68CBD4D3DF1BA445FFC8A693AADE300CEA98EF942BA404FC
                                                                                                                                                              SHA-512:0C990D2EABBC202BCEB363259F2BE2B68CA51C9784D48C330677E5ABC1DDBC3F44CC1F946E1771845AEC0380080BEF8B249C7B0A8A997C229F29808166012836
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:low
                                                                                                                                                              Preview:P.t..Hp.y.U.H...J....8..=..|^.F..O..D.K.......Jv.o......U6.1..,`D...~.Y/.Pe.'-.1i....`Se.....8....*....I.^.r...$..!..9...

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\GGGGGGGGGGG (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.5285554530473515
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:DvKOnan8bIswbr/dvGQ1Im/MPLSyJVzE7+col:+IanmIP1hKmyJtjl
                                                                                                                                                              MD5:A09443444F33169624379B9D51FC6488
                                                                                                                                                              SHA1:D29BDEC3E34278C4A36C5B8DC9AEDF6A92C8F160
                                                                                                                                                              SHA-256:32F15D73E7781E8D68CBD4D3DF1BA445FFC8A693AADE300CEA98EF942BA404FC
                                                                                                                                                              SHA-512:0C990D2EABBC202BCEB363259F2BE2B68CA51C9784D48C330677E5ABC1DDBC3F44CC1F946E1771845AEC0380080BEF8B249C7B0A8A997C229F29808166012836
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:low
                                                                                                                                                              Preview:P.t..Hp.y.U.H...J....8..=..|^.F..O..D.K.......Jv.o......U6.1..,`D...~.Y/.Pe.'-.1i....`Se.....8....*....I.^.r...$..!..9...

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\HHHHHHHHHHH (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.5285554530473515
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:DvKOnan8bIswbr/dvGQ1Im/MPLSyJVzE7+col:+IanmIP1hKmyJtjl
                                                                                                                                                              MD5:A09443444F33169624379B9D51FC6488
                                                                                                                                                              SHA1:D29BDEC3E34278C4A36C5B8DC9AEDF6A92C8F160
                                                                                                                                                              SHA-256:32F15D73E7781E8D68CBD4D3DF1BA445FFC8A693AADE300CEA98EF942BA404FC
                                                                                                                                                              SHA-512:0C990D2EABBC202BCEB363259F2BE2B68CA51C9784D48C330677E5ABC1DDBC3F44CC1F946E1771845AEC0380080BEF8B249C7B0A8A997C229F29808166012836
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:low
                                                                                                                                                              Preview:P.t..Hp.y.U.H...J....8..=..|^.F..O..D.K.......Jv.o......U6.1..,`D...~.Y/.Pe.'-.1i....`Se.....8....*....I.^.r...$..!..9...

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\IIIIIIIIIII (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.5285554530473515
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:DvKOnan8bIswbr/dvGQ1Im/MPLSyJVzE7+col:+IanmIP1hKmyJtjl
                                                                                                                                                              MD5:A09443444F33169624379B9D51FC6488
                                                                                                                                                              SHA1:D29BDEC3E34278C4A36C5B8DC9AEDF6A92C8F160
                                                                                                                                                              SHA-256:32F15D73E7781E8D68CBD4D3DF1BA445FFC8A693AADE300CEA98EF942BA404FC
                                                                                                                                                              SHA-512:0C990D2EABBC202BCEB363259F2BE2B68CA51C9784D48C330677E5ABC1DDBC3F44CC1F946E1771845AEC0380080BEF8B249C7B0A8A997C229F29808166012836
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:low
                                                                                                                                                              Preview:P.t..Hp.y.U.H...J....8..=..|^.F..O..D.K.......Jv.o......U6.1..,`D...~.Y/.Pe.'-.1i....`Se.....8....*....I.^.r...$..!..9...

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\JJJJJJJJJJJ (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.5285554530473515
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:DvKOnan8bIswbr/dvGQ1Im/MPLSyJVzE7+col:+IanmIP1hKmyJtjl
                                                                                                                                                              MD5:A09443444F33169624379B9D51FC6488
                                                                                                                                                              SHA1:D29BDEC3E34278C4A36C5B8DC9AEDF6A92C8F160
                                                                                                                                                              SHA-256:32F15D73E7781E8D68CBD4D3DF1BA445FFC8A693AADE300CEA98EF942BA404FC
                                                                                                                                                              SHA-512:0C990D2EABBC202BCEB363259F2BE2B68CA51C9784D48C330677E5ABC1DDBC3F44CC1F946E1771845AEC0380080BEF8B249C7B0A8A997C229F29808166012836
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:P.t..Hp.y.U.H...J....8..=..|^.F..O..D.K.......Jv.o......U6.1..,`D...~.Y/.Pe.'-.1i....`Se.....8....*....I.^.r...$..!..9...

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\KKKKKKKKKKK (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.5285554530473515
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:DvKOnan8bIswbr/dvGQ1Im/MPLSyJVzE7+col:+IanmIP1hKmyJtjl
                                                                                                                                                              MD5:A09443444F33169624379B9D51FC6488
                                                                                                                                                              SHA1:D29BDEC3E34278C4A36C5B8DC9AEDF6A92C8F160
                                                                                                                                                              SHA-256:32F15D73E7781E8D68CBD4D3DF1BA445FFC8A693AADE300CEA98EF942BA404FC
                                                                                                                                                              SHA-512:0C990D2EABBC202BCEB363259F2BE2B68CA51C9784D48C330677E5ABC1DDBC3F44CC1F946E1771845AEC0380080BEF8B249C7B0A8A997C229F29808166012836
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:P.t..Hp.y.U.H...J....8..=..|^.F..O..D.K.......Jv.o......U6.1..,`D...~.Y/.Pe.'-.1i....`Se.....8....*....I.^.r...$..!..9...

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\LLLLLLLLLLL (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.5285554530473515
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:DvKOnan8bIswbr/dvGQ1Im/MPLSyJVzE7+col:+IanmIP1hKmyJtjl
                                                                                                                                                              MD5:A09443444F33169624379B9D51FC6488
                                                                                                                                                              SHA1:D29BDEC3E34278C4A36C5B8DC9AEDF6A92C8F160
                                                                                                                                                              SHA-256:32F15D73E7781E8D68CBD4D3DF1BA445FFC8A693AADE300CEA98EF942BA404FC
                                                                                                                                                              SHA-512:0C990D2EABBC202BCEB363259F2BE2B68CA51C9784D48C330677E5ABC1DDBC3F44CC1F946E1771845AEC0380080BEF8B249C7B0A8A997C229F29808166012836
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:P.t..Hp.y.U.H...J....8..=..|^.F..O..D.K.......Jv.o......U6.1..,`D...~.Y/.Pe.'-.1i....`Se.....8....*....I.^.r...$..!..9...

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\MMMMMMMMMMM (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.5285554530473515
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:DvKOnan8bIswbr/dvGQ1Im/MPLSyJVzE7+col:+IanmIP1hKmyJtjl
                                                                                                                                                              MD5:A09443444F33169624379B9D51FC6488
                                                                                                                                                              SHA1:D29BDEC3E34278C4A36C5B8DC9AEDF6A92C8F160
                                                                                                                                                              SHA-256:32F15D73E7781E8D68CBD4D3DF1BA445FFC8A693AADE300CEA98EF942BA404FC
                                                                                                                                                              SHA-512:0C990D2EABBC202BCEB363259F2BE2B68CA51C9784D48C330677E5ABC1DDBC3F44CC1F946E1771845AEC0380080BEF8B249C7B0A8A997C229F29808166012836
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:P.t..Hp.y.U.H...J....8..=..|^.F..O..D.K.......Jv.o......U6.1..,`D...~.Y/.Pe.'-.1i....`Se.....8....*....I.^.r...$..!..9...

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\NNNNNNNNNNN (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.5285554530473515
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:DvKOnan8bIswbr/dvGQ1Im/MPLSyJVzE7+col:+IanmIP1hKmyJtjl
                                                                                                                                                              MD5:A09443444F33169624379B9D51FC6488
                                                                                                                                                              SHA1:D29BDEC3E34278C4A36C5B8DC9AEDF6A92C8F160
                                                                                                                                                              SHA-256:32F15D73E7781E8D68CBD4D3DF1BA445FFC8A693AADE300CEA98EF942BA404FC
                                                                                                                                                              SHA-512:0C990D2EABBC202BCEB363259F2BE2B68CA51C9784D48C330677E5ABC1DDBC3F44CC1F946E1771845AEC0380080BEF8B249C7B0A8A997C229F29808166012836
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:P.t..Hp.y.U.H...J....8..=..|^.F..O..D.K.......Jv.o......U6.1..,`D...~.Y/.Pe.'-.1i....`Se.....8....*....I.^.r...$..!..9...

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\OOOOOOOOOOO (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.5285554530473515
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:DvKOnan8bIswbr/dvGQ1Im/MPLSyJVzE7+col:+IanmIP1hKmyJtjl
                                                                                                                                                              MD5:A09443444F33169624379B9D51FC6488
                                                                                                                                                              SHA1:D29BDEC3E34278C4A36C5B8DC9AEDF6A92C8F160
                                                                                                                                                              SHA-256:32F15D73E7781E8D68CBD4D3DF1BA445FFC8A693AADE300CEA98EF942BA404FC
                                                                                                                                                              SHA-512:0C990D2EABBC202BCEB363259F2BE2B68CA51C9784D48C330677E5ABC1DDBC3F44CC1F946E1771845AEC0380080BEF8B249C7B0A8A997C229F29808166012836
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:P.t..Hp.y.U.H...J....8..=..|^.F..O..D.K.......Jv.o......U6.1..,`D...~.Y/.Pe.'-.1i....`Se.....8....*....I.^.r...$..!..9...

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\PPPPPPPPPPP (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.5285554530473515
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:DvKOnan8bIswbr/dvGQ1Im/MPLSyJVzE7+col:+IanmIP1hKmyJtjl
                                                                                                                                                              MD5:A09443444F33169624379B9D51FC6488
                                                                                                                                                              SHA1:D29BDEC3E34278C4A36C5B8DC9AEDF6A92C8F160
                                                                                                                                                              SHA-256:32F15D73E7781E8D68CBD4D3DF1BA445FFC8A693AADE300CEA98EF942BA404FC
                                                                                                                                                              SHA-512:0C990D2EABBC202BCEB363259F2BE2B68CA51C9784D48C330677E5ABC1DDBC3F44CC1F946E1771845AEC0380080BEF8B249C7B0A8A997C229F29808166012836
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:P.t..Hp.y.U.H...J....8..=..|^.F..O..D.K.......Jv.o......U6.1..,`D...~.Y/.Pe.'-.1i....`Se.....8....*....I.^.r...$..!..9...

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\QQQQQQQQQQQ (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.5285554530473515
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:DvKOnan8bIswbr/dvGQ1Im/MPLSyJVzE7+col:+IanmIP1hKmyJtjl
                                                                                                                                                              MD5:A09443444F33169624379B9D51FC6488
                                                                                                                                                              SHA1:D29BDEC3E34278C4A36C5B8DC9AEDF6A92C8F160
                                                                                                                                                              SHA-256:32F15D73E7781E8D68CBD4D3DF1BA445FFC8A693AADE300CEA98EF942BA404FC
                                                                                                                                                              SHA-512:0C990D2EABBC202BCEB363259F2BE2B68CA51C9784D48C330677E5ABC1DDBC3F44CC1F946E1771845AEC0380080BEF8B249C7B0A8A997C229F29808166012836
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:P.t..Hp.y.U.H...J....8..=..|^.F..O..D.K.......Jv.o......U6.1..,`D...~.Y/.Pe.'-.1i....`Se.....8....*....I.^.r...$..!..9...

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\RRRRRRRRRRR (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.5285554530473515
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:DvKOnan8bIswbr/dvGQ1Im/MPLSyJVzE7+col:+IanmIP1hKmyJtjl
                                                                                                                                                              MD5:A09443444F33169624379B9D51FC6488
                                                                                                                                                              SHA1:D29BDEC3E34278C4A36C5B8DC9AEDF6A92C8F160
                                                                                                                                                              SHA-256:32F15D73E7781E8D68CBD4D3DF1BA445FFC8A693AADE300CEA98EF942BA404FC
                                                                                                                                                              SHA-512:0C990D2EABBC202BCEB363259F2BE2B68CA51C9784D48C330677E5ABC1DDBC3F44CC1F946E1771845AEC0380080BEF8B249C7B0A8A997C229F29808166012836
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:P.t..Hp.y.U.H...J....8..=..|^.F..O..D.K.......Jv.o......U6.1..,`D...~.Y/.Pe.'-.1i....`Se.....8....*....I.^.r...$..!..9...

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\SSSSSSSSSSS (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.5285554530473515
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:DvKOnan8bIswbr/dvGQ1Im/MPLSyJVzE7+col:+IanmIP1hKmyJtjl
                                                                                                                                                              MD5:A09443444F33169624379B9D51FC6488
                                                                                                                                                              SHA1:D29BDEC3E34278C4A36C5B8DC9AEDF6A92C8F160
                                                                                                                                                              SHA-256:32F15D73E7781E8D68CBD4D3DF1BA445FFC8A693AADE300CEA98EF942BA404FC
                                                                                                                                                              SHA-512:0C990D2EABBC202BCEB363259F2BE2B68CA51C9784D48C330677E5ABC1DDBC3F44CC1F946E1771845AEC0380080BEF8B249C7B0A8A997C229F29808166012836
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:P.t..Hp.y.U.H...J....8..=..|^.F..O..D.K.......Jv.o......U6.1..,`D...~.Y/.Pe.'-.1i....`Se.....8....*....I.^.r...$..!..9...

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\TTTTTTTTTTT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.5285554530473515
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:DvKOnan8bIswbr/dvGQ1Im/MPLSyJVzE7+col:+IanmIP1hKmyJtjl
                                                                                                                                                              MD5:A09443444F33169624379B9D51FC6488
                                                                                                                                                              SHA1:D29BDEC3E34278C4A36C5B8DC9AEDF6A92C8F160
                                                                                                                                                              SHA-256:32F15D73E7781E8D68CBD4D3DF1BA445FFC8A693AADE300CEA98EF942BA404FC
                                                                                                                                                              SHA-512:0C990D2EABBC202BCEB363259F2BE2B68CA51C9784D48C330677E5ABC1DDBC3F44CC1F946E1771845AEC0380080BEF8B249C7B0A8A997C229F29808166012836
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:P.t..Hp.y.U.H...J....8..=..|^.F..O..D.K.......Jv.o......U6.1..,`D...~.Y/.Pe.'-.1i....`Se.....8....*....I.^.r...$..!..9...

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\UUUUUUUUUUU (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.5285554530473515
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:DvKOnan8bIswbr/dvGQ1Im/MPLSyJVzE7+col:+IanmIP1hKmyJtjl
                                                                                                                                                              MD5:A09443444F33169624379B9D51FC6488
                                                                                                                                                              SHA1:D29BDEC3E34278C4A36C5B8DC9AEDF6A92C8F160
                                                                                                                                                              SHA-256:32F15D73E7781E8D68CBD4D3DF1BA445FFC8A693AADE300CEA98EF942BA404FC
                                                                                                                                                              SHA-512:0C990D2EABBC202BCEB363259F2BE2B68CA51C9784D48C330677E5ABC1DDBC3F44CC1F946E1771845AEC0380080BEF8B249C7B0A8A997C229F29808166012836
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:P.t..Hp.y.U.H...J....8..=..|^.F..O..D.K.......Jv.o......U6.1..,`D...~.Y/.Pe.'-.1i....`Se.....8....*....I.^.r...$..!..9...

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\VVVVVVVVVVV (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.5285554530473515
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:DvKOnan8bIswbr/dvGQ1Im/MPLSyJVzE7+col:+IanmIP1hKmyJtjl
                                                                                                                                                              MD5:A09443444F33169624379B9D51FC6488
                                                                                                                                                              SHA1:D29BDEC3E34278C4A36C5B8DC9AEDF6A92C8F160
                                                                                                                                                              SHA-256:32F15D73E7781E8D68CBD4D3DF1BA445FFC8A693AADE300CEA98EF942BA404FC
                                                                                                                                                              SHA-512:0C990D2EABBC202BCEB363259F2BE2B68CA51C9784D48C330677E5ABC1DDBC3F44CC1F946E1771845AEC0380080BEF8B249C7B0A8A997C229F29808166012836
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:P.t..Hp.y.U.H...J....8..=..|^.F..O..D.K.......Jv.o......U6.1..,`D...~.Y/.Pe.'-.1i....`Se.....8....*....I.^.r...$..!..9...

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\WWWWWWWWWWW (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.5285554530473515
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:DvKOnan8bIswbr/dvGQ1Im/MPLSyJVzE7+col:+IanmIP1hKmyJtjl
                                                                                                                                                              MD5:A09443444F33169624379B9D51FC6488
                                                                                                                                                              SHA1:D29BDEC3E34278C4A36C5B8DC9AEDF6A92C8F160
                                                                                                                                                              SHA-256:32F15D73E7781E8D68CBD4D3DF1BA445FFC8A693AADE300CEA98EF942BA404FC
                                                                                                                                                              SHA-512:0C990D2EABBC202BCEB363259F2BE2B68CA51C9784D48C330677E5ABC1DDBC3F44CC1F946E1771845AEC0380080BEF8B249C7B0A8A997C229F29808166012836
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:P.t..Hp.y.U.H...J....8..=..|^.F..O..D.K.......Jv.o......U6.1..,`D...~.Y/.Pe.'-.1i....`Se.....8....*....I.^.r...$..!..9...

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\XXXXXXXXXXX (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.5285554530473515
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:DvKOnan8bIswbr/dvGQ1Im/MPLSyJVzE7+col:+IanmIP1hKmyJtjl
                                                                                                                                                              MD5:A09443444F33169624379B9D51FC6488
                                                                                                                                                              SHA1:D29BDEC3E34278C4A36C5B8DC9AEDF6A92C8F160
                                                                                                                                                              SHA-256:32F15D73E7781E8D68CBD4D3DF1BA445FFC8A693AADE300CEA98EF942BA404FC
                                                                                                                                                              SHA-512:0C990D2EABBC202BCEB363259F2BE2B68CA51C9784D48C330677E5ABC1DDBC3F44CC1F946E1771845AEC0380080BEF8B249C7B0A8A997C229F29808166012836
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:P.t..Hp.y.U.H...J....8..=..|^.F..O..D.K.......Jv.o......U6.1..,`D...~.Y/.Pe.'-.1i....`Se.....8....*....I.^.r...$..!..9...

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\YYYYYYYYYYY (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.5285554530473515
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:DvKOnan8bIswbr/dvGQ1Im/MPLSyJVzE7+col:+IanmIP1hKmyJtjl
                                                                                                                                                              MD5:A09443444F33169624379B9D51FC6488
                                                                                                                                                              SHA1:D29BDEC3E34278C4A36C5B8DC9AEDF6A92C8F160
                                                                                                                                                              SHA-256:32F15D73E7781E8D68CBD4D3DF1BA445FFC8A693AADE300CEA98EF942BA404FC
                                                                                                                                                              SHA-512:0C990D2EABBC202BCEB363259F2BE2B68CA51C9784D48C330677E5ABC1DDBC3F44CC1F946E1771845AEC0380080BEF8B249C7B0A8A997C229F29808166012836
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:P.t..Hp.y.U.H...J....8..=..|^.F..O..D.K.......Jv.o......U6.1..,`D...~.Y/.Pe.'-.1i....`Se.....8....*....I.^.r...$..!..9...

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\ZZZZZZZZZZZ (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.5285554530473515
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:DvKOnan8bIswbr/dvGQ1Im/MPLSyJVzE7+col:+IanmIP1hKmyJtjl
                                                                                                                                                              MD5:A09443444F33169624379B9D51FC6488
                                                                                                                                                              SHA1:D29BDEC3E34278C4A36C5B8DC9AEDF6A92C8F160
                                                                                                                                                              SHA-256:32F15D73E7781E8D68CBD4D3DF1BA445FFC8A693AADE300CEA98EF942BA404FC
                                                                                                                                                              SHA-512:0C990D2EABBC202BCEB363259F2BE2B68CA51C9784D48C330677E5ABC1DDBC3F44CC1F946E1771845AEC0380080BEF8B249C7B0A8A997C229F29808166012836
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:P.t..Hp.y.U.H...J....8..=..|^.F..O..D.K.......Jv.o......U6.1..,`D...~.Y/.Pe.'-.1i....`Se.....8....*....I.^.r...$..!..9...

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.ini

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.5285554530473515
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:DvKOnan8bIswbr/dvGQ1Im/MPLSyJVzE7+col:+IanmIP1hKmyJtjl
                                                                                                                                                              MD5:A09443444F33169624379B9D51FC6488
                                                                                                                                                              SHA1:D29BDEC3E34278C4A36C5B8DC9AEDF6A92C8F160
                                                                                                                                                              SHA-256:32F15D73E7781E8D68CBD4D3DF1BA445FFC8A693AADE300CEA98EF942BA404FC
                                                                                                                                                              SHA-512:0C990D2EABBC202BCEB363259F2BE2B68CA51C9784D48C330677E5ABC1DDBC3F44CC1F946E1771845AEC0380080BEF8B249C7B0A8A997C229F29808166012836
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:P.t..Hp.y.U.H...J....8..=..|^.F..O..D.K.......Jv.o......U6.1..,`D...~.Y/.Pe.'-.1i....`Se.....8....*....I.^.r...$..!..9...

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\AAAAAAAAAAA (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:GeoSwath RDF
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.637082584830295
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:WMNzk2IY4kiwrPxBWrhP/Hvp0vi9ucjgP6hNyeBNn:WM+2v4kiw9BWtnHvnvgihIMN
                                                                                                                                                              MD5:ACDE424F8BE99C17989D139626FE2976
                                                                                                                                                              SHA1:B2AA412E426DF9ECCA591E82C4C73978DD3767E2
                                                                                                                                                              SHA-256:0C2B7E572F3EF6710E2C921CA0C8797AEE53680D6FDC4A2CE3C1E7528D8BD030
                                                                                                                                                              SHA-512:B8584246498A5B8733F161FA51BD80F8FE5F71DFACFE537C2CF6D66FDE5E22E3AEE46D2735DFA81382AFDADE67CE4E9A4C26188727712D8A3F81E5757C04581B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.... ...h0.(^...}._"f.....Q.C..G{vU4)l..'VN0.m....>4.......l..U.f....d9o...J.L*.B..Q./P.@.&}......)i1SW..cRy.....!...Q.ZszL.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\BBBBBBBBBBB (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:GeoSwath RDF
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.637082584830295
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:WMNzk2IY4kiwrPxBWrhP/Hvp0vi9ucjgP6hNyeBNn:WM+2v4kiw9BWtnHvnvgihIMN
                                                                                                                                                              MD5:ACDE424F8BE99C17989D139626FE2976
                                                                                                                                                              SHA1:B2AA412E426DF9ECCA591E82C4C73978DD3767E2
                                                                                                                                                              SHA-256:0C2B7E572F3EF6710E2C921CA0C8797AEE53680D6FDC4A2CE3C1E7528D8BD030
                                                                                                                                                              SHA-512:B8584246498A5B8733F161FA51BD80F8FE5F71DFACFE537C2CF6D66FDE5E22E3AEE46D2735DFA81382AFDADE67CE4E9A4C26188727712D8A3F81E5757C04581B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.... ...h0.(^...}._"f.....Q.C..G{vU4)l..'VN0.m....>4.......l..U.f....d9o...J.L*.B..Q./P.@.&}......)i1SW..cRy.....!...Q.ZszL.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\CCCCCCCCCCC (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:GeoSwath RDF
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.637082584830295
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:WMNzk2IY4kiwrPxBWrhP/Hvp0vi9ucjgP6hNyeBNn:WM+2v4kiw9BWtnHvnvgihIMN
                                                                                                                                                              MD5:ACDE424F8BE99C17989D139626FE2976
                                                                                                                                                              SHA1:B2AA412E426DF9ECCA591E82C4C73978DD3767E2
                                                                                                                                                              SHA-256:0C2B7E572F3EF6710E2C921CA0C8797AEE53680D6FDC4A2CE3C1E7528D8BD030
                                                                                                                                                              SHA-512:B8584246498A5B8733F161FA51BD80F8FE5F71DFACFE537C2CF6D66FDE5E22E3AEE46D2735DFA81382AFDADE67CE4E9A4C26188727712D8A3F81E5757C04581B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.... ...h0.(^...}._"f.....Q.C..G{vU4)l..'VN0.m....>4.......l..U.f....d9o...J.L*.B..Q./P.@.&}......)i1SW..cRy.....!...Q.ZszL.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\DDDDDDDDDDD (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:GeoSwath RDF
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.637082584830295
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:WMNzk2IY4kiwrPxBWrhP/Hvp0vi9ucjgP6hNyeBNn:WM+2v4kiw9BWtnHvnvgihIMN
                                                                                                                                                              MD5:ACDE424F8BE99C17989D139626FE2976
                                                                                                                                                              SHA1:B2AA412E426DF9ECCA591E82C4C73978DD3767E2
                                                                                                                                                              SHA-256:0C2B7E572F3EF6710E2C921CA0C8797AEE53680D6FDC4A2CE3C1E7528D8BD030
                                                                                                                                                              SHA-512:B8584246498A5B8733F161FA51BD80F8FE5F71DFACFE537C2CF6D66FDE5E22E3AEE46D2735DFA81382AFDADE67CE4E9A4C26188727712D8A3F81E5757C04581B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.... ...h0.(^...}._"f.....Q.C..G{vU4)l..'VN0.m....>4.......l..U.f....d9o...J.L*.B..Q./P.@.&}......)i1SW..cRy.....!...Q.ZszL.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\EEEEEEEEEEE (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:GeoSwath RDF
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.637082584830295
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:WMNzk2IY4kiwrPxBWrhP/Hvp0vi9ucjgP6hNyeBNn:WM+2v4kiw9BWtnHvnvgihIMN
                                                                                                                                                              MD5:ACDE424F8BE99C17989D139626FE2976
                                                                                                                                                              SHA1:B2AA412E426DF9ECCA591E82C4C73978DD3767E2
                                                                                                                                                              SHA-256:0C2B7E572F3EF6710E2C921CA0C8797AEE53680D6FDC4A2CE3C1E7528D8BD030
                                                                                                                                                              SHA-512:B8584246498A5B8733F161FA51BD80F8FE5F71DFACFE537C2CF6D66FDE5E22E3AEE46D2735DFA81382AFDADE67CE4E9A4C26188727712D8A3F81E5757C04581B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.... ...h0.(^...}._"f.....Q.C..G{vU4)l..'VN0.m....>4.......l..U.f....d9o...J.L*.B..Q./P.@.&}......)i1SW..cRy.....!...Q.ZszL.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\FFFFFFFFFFF (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:GeoSwath RDF
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.637082584830295
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:WMNzk2IY4kiwrPxBWrhP/Hvp0vi9ucjgP6hNyeBNn:WM+2v4kiw9BWtnHvnvgihIMN
                                                                                                                                                              MD5:ACDE424F8BE99C17989D139626FE2976
                                                                                                                                                              SHA1:B2AA412E426DF9ECCA591E82C4C73978DD3767E2
                                                                                                                                                              SHA-256:0C2B7E572F3EF6710E2C921CA0C8797AEE53680D6FDC4A2CE3C1E7528D8BD030
                                                                                                                                                              SHA-512:B8584246498A5B8733F161FA51BD80F8FE5F71DFACFE537C2CF6D66FDE5E22E3AEE46D2735DFA81382AFDADE67CE4E9A4C26188727712D8A3F81E5757C04581B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.... ...h0.(^...}._"f.....Q.C..G{vU4)l..'VN0.m....>4.......l..U.f....d9o...J.L*.B..Q./P.@.&}......)i1SW..cRy.....!...Q.ZszL.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\GGGGGGGGGGG (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:GeoSwath RDF
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.637082584830295
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:WMNzk2IY4kiwrPxBWrhP/Hvp0vi9ucjgP6hNyeBNn:WM+2v4kiw9BWtnHvnvgihIMN
                                                                                                                                                              MD5:ACDE424F8BE99C17989D139626FE2976
                                                                                                                                                              SHA1:B2AA412E426DF9ECCA591E82C4C73978DD3767E2
                                                                                                                                                              SHA-256:0C2B7E572F3EF6710E2C921CA0C8797AEE53680D6FDC4A2CE3C1E7528D8BD030
                                                                                                                                                              SHA-512:B8584246498A5B8733F161FA51BD80F8FE5F71DFACFE537C2CF6D66FDE5E22E3AEE46D2735DFA81382AFDADE67CE4E9A4C26188727712D8A3F81E5757C04581B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.... ...h0.(^...}._"f.....Q.C..G{vU4)l..'VN0.m....>4.......l..U.f....d9o...J.L*.B..Q./P.@.&}......)i1SW..cRy.....!...Q.ZszL.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\HHHHHHHHHHH (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:GeoSwath RDF
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.637082584830295
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:WMNzk2IY4kiwrPxBWrhP/Hvp0vi9ucjgP6hNyeBNn:WM+2v4kiw9BWtnHvnvgihIMN
                                                                                                                                                              MD5:ACDE424F8BE99C17989D139626FE2976
                                                                                                                                                              SHA1:B2AA412E426DF9ECCA591E82C4C73978DD3767E2
                                                                                                                                                              SHA-256:0C2B7E572F3EF6710E2C921CA0C8797AEE53680D6FDC4A2CE3C1E7528D8BD030
                                                                                                                                                              SHA-512:B8584246498A5B8733F161FA51BD80F8FE5F71DFACFE537C2CF6D66FDE5E22E3AEE46D2735DFA81382AFDADE67CE4E9A4C26188727712D8A3F81E5757C04581B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.... ...h0.(^...}._"f.....Q.C..G{vU4)l..'VN0.m....>4.......l..U.f....d9o...J.L*.B..Q./P.@.&}......)i1SW..cRy.....!...Q.ZszL.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\IIIIIIIIIII (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:GeoSwath RDF
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.637082584830295
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:WMNzk2IY4kiwrPxBWrhP/Hvp0vi9ucjgP6hNyeBNn:WM+2v4kiw9BWtnHvnvgihIMN
                                                                                                                                                              MD5:ACDE424F8BE99C17989D139626FE2976
                                                                                                                                                              SHA1:B2AA412E426DF9ECCA591E82C4C73978DD3767E2
                                                                                                                                                              SHA-256:0C2B7E572F3EF6710E2C921CA0C8797AEE53680D6FDC4A2CE3C1E7528D8BD030
                                                                                                                                                              SHA-512:B8584246498A5B8733F161FA51BD80F8FE5F71DFACFE537C2CF6D66FDE5E22E3AEE46D2735DFA81382AFDADE67CE4E9A4C26188727712D8A3F81E5757C04581B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.... ...h0.(^...}._"f.....Q.C..G{vU4)l..'VN0.m....>4.......l..U.f....d9o...J.L*.B..Q./P.@.&}......)i1SW..cRy.....!...Q.ZszL.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\JJJJJJJJJJJ (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:GeoSwath RDF
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.637082584830295
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:WMNzk2IY4kiwrPxBWrhP/Hvp0vi9ucjgP6hNyeBNn:WM+2v4kiw9BWtnHvnvgihIMN
                                                                                                                                                              MD5:ACDE424F8BE99C17989D139626FE2976
                                                                                                                                                              SHA1:B2AA412E426DF9ECCA591E82C4C73978DD3767E2
                                                                                                                                                              SHA-256:0C2B7E572F3EF6710E2C921CA0C8797AEE53680D6FDC4A2CE3C1E7528D8BD030
                                                                                                                                                              SHA-512:B8584246498A5B8733F161FA51BD80F8FE5F71DFACFE537C2CF6D66FDE5E22E3AEE46D2735DFA81382AFDADE67CE4E9A4C26188727712D8A3F81E5757C04581B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.... ...h0.(^...}._"f.....Q.C..G{vU4)l..'VN0.m....>4.......l..U.f....d9o...J.L*.B..Q./P.@.&}......)i1SW..cRy.....!...Q.ZszL.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\KKKKKKKKKKK (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:GeoSwath RDF
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.637082584830295
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:WMNzk2IY4kiwrPxBWrhP/Hvp0vi9ucjgP6hNyeBNn:WM+2v4kiw9BWtnHvnvgihIMN
                                                                                                                                                              MD5:ACDE424F8BE99C17989D139626FE2976
                                                                                                                                                              SHA1:B2AA412E426DF9ECCA591E82C4C73978DD3767E2
                                                                                                                                                              SHA-256:0C2B7E572F3EF6710E2C921CA0C8797AEE53680D6FDC4A2CE3C1E7528D8BD030
                                                                                                                                                              SHA-512:B8584246498A5B8733F161FA51BD80F8FE5F71DFACFE537C2CF6D66FDE5E22E3AEE46D2735DFA81382AFDADE67CE4E9A4C26188727712D8A3F81E5757C04581B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.... ...h0.(^...}._"f.....Q.C..G{vU4)l..'VN0.m....>4.......l..U.f....d9o...J.L*.B..Q./P.@.&}......)i1SW..cRy.....!...Q.ZszL.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\LLLLLLLLLLL (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:GeoSwath RDF
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.637082584830295
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:WMNzk2IY4kiwrPxBWrhP/Hvp0vi9ucjgP6hNyeBNn:WM+2v4kiw9BWtnHvnvgihIMN
                                                                                                                                                              MD5:ACDE424F8BE99C17989D139626FE2976
                                                                                                                                                              SHA1:B2AA412E426DF9ECCA591E82C4C73978DD3767E2
                                                                                                                                                              SHA-256:0C2B7E572F3EF6710E2C921CA0C8797AEE53680D6FDC4A2CE3C1E7528D8BD030
                                                                                                                                                              SHA-512:B8584246498A5B8733F161FA51BD80F8FE5F71DFACFE537C2CF6D66FDE5E22E3AEE46D2735DFA81382AFDADE67CE4E9A4C26188727712D8A3F81E5757C04581B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.... ...h0.(^...}._"f.....Q.C..G{vU4)l..'VN0.m....>4.......l..U.f....d9o...J.L*.B..Q./P.@.&}......)i1SW..cRy.....!...Q.ZszL.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\MMMMMMMMMMM (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:GeoSwath RDF
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.637082584830295
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:WMNzk2IY4kiwrPxBWrhP/Hvp0vi9ucjgP6hNyeBNn:WM+2v4kiw9BWtnHvnvgihIMN
                                                                                                                                                              MD5:ACDE424F8BE99C17989D139626FE2976
                                                                                                                                                              SHA1:B2AA412E426DF9ECCA591E82C4C73978DD3767E2
                                                                                                                                                              SHA-256:0C2B7E572F3EF6710E2C921CA0C8797AEE53680D6FDC4A2CE3C1E7528D8BD030
                                                                                                                                                              SHA-512:B8584246498A5B8733F161FA51BD80F8FE5F71DFACFE537C2CF6D66FDE5E22E3AEE46D2735DFA81382AFDADE67CE4E9A4C26188727712D8A3F81E5757C04581B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.... ...h0.(^...}._"f.....Q.C..G{vU4)l..'VN0.m....>4.......l..U.f....d9o...J.L*.B..Q./P.@.&}......)i1SW..cRy.....!...Q.ZszL.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\NNNNNNNNNNN (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:GeoSwath RDF
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.637082584830295
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:WMNzk2IY4kiwrPxBWrhP/Hvp0vi9ucjgP6hNyeBNn:WM+2v4kiw9BWtnHvnvgihIMN
                                                                                                                                                              MD5:ACDE424F8BE99C17989D139626FE2976
                                                                                                                                                              SHA1:B2AA412E426DF9ECCA591E82C4C73978DD3767E2
                                                                                                                                                              SHA-256:0C2B7E572F3EF6710E2C921CA0C8797AEE53680D6FDC4A2CE3C1E7528D8BD030
                                                                                                                                                              SHA-512:B8584246498A5B8733F161FA51BD80F8FE5F71DFACFE537C2CF6D66FDE5E22E3AEE46D2735DFA81382AFDADE67CE4E9A4C26188727712D8A3F81E5757C04581B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.... ...h0.(^...}._"f.....Q.C..G{vU4)l..'VN0.m....>4.......l..U.f....d9o...J.L*.B..Q./P.@.&}......)i1SW..cRy.....!...Q.ZszL.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\OOOOOOOOOOO (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:GeoSwath RDF
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.637082584830295
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:WMNzk2IY4kiwrPxBWrhP/Hvp0vi9ucjgP6hNyeBNn:WM+2v4kiw9BWtnHvnvgihIMN
                                                                                                                                                              MD5:ACDE424F8BE99C17989D139626FE2976
                                                                                                                                                              SHA1:B2AA412E426DF9ECCA591E82C4C73978DD3767E2
                                                                                                                                                              SHA-256:0C2B7E572F3EF6710E2C921CA0C8797AEE53680D6FDC4A2CE3C1E7528D8BD030
                                                                                                                                                              SHA-512:B8584246498A5B8733F161FA51BD80F8FE5F71DFACFE537C2CF6D66FDE5E22E3AEE46D2735DFA81382AFDADE67CE4E9A4C26188727712D8A3F81E5757C04581B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.... ...h0.(^...}._"f.....Q.C..G{vU4)l..'VN0.m....>4.......l..U.f....d9o...J.L*.B..Q./P.@.&}......)i1SW..cRy.....!...Q.ZszL.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\PPPPPPPPPPP (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:GeoSwath RDF
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.637082584830295
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:WMNzk2IY4kiwrPxBWrhP/Hvp0vi9ucjgP6hNyeBNn:WM+2v4kiw9BWtnHvnvgihIMN
                                                                                                                                                              MD5:ACDE424F8BE99C17989D139626FE2976
                                                                                                                                                              SHA1:B2AA412E426DF9ECCA591E82C4C73978DD3767E2
                                                                                                                                                              SHA-256:0C2B7E572F3EF6710E2C921CA0C8797AEE53680D6FDC4A2CE3C1E7528D8BD030
                                                                                                                                                              SHA-512:B8584246498A5B8733F161FA51BD80F8FE5F71DFACFE537C2CF6D66FDE5E22E3AEE46D2735DFA81382AFDADE67CE4E9A4C26188727712D8A3F81E5757C04581B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.... ...h0.(^...}._"f.....Q.C..G{vU4)l..'VN0.m....>4.......l..U.f....d9o...J.L*.B..Q./P.@.&}......)i1SW..cRy.....!...Q.ZszL.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\QQQQQQQQQQQ (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:GeoSwath RDF
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.637082584830295
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:WMNzk2IY4kiwrPxBWrhP/Hvp0vi9ucjgP6hNyeBNn:WM+2v4kiw9BWtnHvnvgihIMN
                                                                                                                                                              MD5:ACDE424F8BE99C17989D139626FE2976
                                                                                                                                                              SHA1:B2AA412E426DF9ECCA591E82C4C73978DD3767E2
                                                                                                                                                              SHA-256:0C2B7E572F3EF6710E2C921CA0C8797AEE53680D6FDC4A2CE3C1E7528D8BD030
                                                                                                                                                              SHA-512:B8584246498A5B8733F161FA51BD80F8FE5F71DFACFE537C2CF6D66FDE5E22E3AEE46D2735DFA81382AFDADE67CE4E9A4C26188727712D8A3F81E5757C04581B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.... ...h0.(^...}._"f.....Q.C..G{vU4)l..'VN0.m....>4.......l..U.f....d9o...J.L*.B..Q./P.@.&}......)i1SW..cRy.....!...Q.ZszL.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\RRRRRRRRRRR (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:GeoSwath RDF
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.637082584830295
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:WMNzk2IY4kiwrPxBWrhP/Hvp0vi9ucjgP6hNyeBNn:WM+2v4kiw9BWtnHvnvgihIMN
                                                                                                                                                              MD5:ACDE424F8BE99C17989D139626FE2976
                                                                                                                                                              SHA1:B2AA412E426DF9ECCA591E82C4C73978DD3767E2
                                                                                                                                                              SHA-256:0C2B7E572F3EF6710E2C921CA0C8797AEE53680D6FDC4A2CE3C1E7528D8BD030
                                                                                                                                                              SHA-512:B8584246498A5B8733F161FA51BD80F8FE5F71DFACFE537C2CF6D66FDE5E22E3AEE46D2735DFA81382AFDADE67CE4E9A4C26188727712D8A3F81E5757C04581B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.... ...h0.(^...}._"f.....Q.C..G{vU4)l..'VN0.m....>4.......l..U.f....d9o...J.L*.B..Q./P.@.&}......)i1SW..cRy.....!...Q.ZszL.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\SSSSSSSSSSS (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:GeoSwath RDF
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.637082584830295
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:WMNzk2IY4kiwrPxBWrhP/Hvp0vi9ucjgP6hNyeBNn:WM+2v4kiw9BWtnHvnvgihIMN
                                                                                                                                                              MD5:ACDE424F8BE99C17989D139626FE2976
                                                                                                                                                              SHA1:B2AA412E426DF9ECCA591E82C4C73978DD3767E2
                                                                                                                                                              SHA-256:0C2B7E572F3EF6710E2C921CA0C8797AEE53680D6FDC4A2CE3C1E7528D8BD030
                                                                                                                                                              SHA-512:B8584246498A5B8733F161FA51BD80F8FE5F71DFACFE537C2CF6D66FDE5E22E3AEE46D2735DFA81382AFDADE67CE4E9A4C26188727712D8A3F81E5757C04581B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.... ...h0.(^...}._"f.....Q.C..G{vU4)l..'VN0.m....>4.......l..U.f....d9o...J.L*.B..Q./P.@.&}......)i1SW..cRy.....!...Q.ZszL.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\TTTTTTTTTTT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:GeoSwath RDF
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.637082584830295
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:WMNzk2IY4kiwrPxBWrhP/Hvp0vi9ucjgP6hNyeBNn:WM+2v4kiw9BWtnHvnvgihIMN
                                                                                                                                                              MD5:ACDE424F8BE99C17989D139626FE2976
                                                                                                                                                              SHA1:B2AA412E426DF9ECCA591E82C4C73978DD3767E2
                                                                                                                                                              SHA-256:0C2B7E572F3EF6710E2C921CA0C8797AEE53680D6FDC4A2CE3C1E7528D8BD030
                                                                                                                                                              SHA-512:B8584246498A5B8733F161FA51BD80F8FE5F71DFACFE537C2CF6D66FDE5E22E3AEE46D2735DFA81382AFDADE67CE4E9A4C26188727712D8A3F81E5757C04581B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.... ...h0.(^...}._"f.....Q.C..G{vU4)l..'VN0.m....>4.......l..U.f....d9o...J.L*.B..Q./P.@.&}......)i1SW..cRy.....!...Q.ZszL.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\UUUUUUUUUUU (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:GeoSwath RDF
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.637082584830295
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:WMNzk2IY4kiwrPxBWrhP/Hvp0vi9ucjgP6hNyeBNn:WM+2v4kiw9BWtnHvnvgihIMN
                                                                                                                                                              MD5:ACDE424F8BE99C17989D139626FE2976
                                                                                                                                                              SHA1:B2AA412E426DF9ECCA591E82C4C73978DD3767E2
                                                                                                                                                              SHA-256:0C2B7E572F3EF6710E2C921CA0C8797AEE53680D6FDC4A2CE3C1E7528D8BD030
                                                                                                                                                              SHA-512:B8584246498A5B8733F161FA51BD80F8FE5F71DFACFE537C2CF6D66FDE5E22E3AEE46D2735DFA81382AFDADE67CE4E9A4C26188727712D8A3F81E5757C04581B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.... ...h0.(^...}._"f.....Q.C..G{vU4)l..'VN0.m....>4.......l..U.f....d9o...J.L*.B..Q./P.@.&}......)i1SW..cRy.....!...Q.ZszL.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\VVVVVVVVVVV (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:GeoSwath RDF
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.637082584830295
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:WMNzk2IY4kiwrPxBWrhP/Hvp0vi9ucjgP6hNyeBNn:WM+2v4kiw9BWtnHvnvgihIMN
                                                                                                                                                              MD5:ACDE424F8BE99C17989D139626FE2976
                                                                                                                                                              SHA1:B2AA412E426DF9ECCA591E82C4C73978DD3767E2
                                                                                                                                                              SHA-256:0C2B7E572F3EF6710E2C921CA0C8797AEE53680D6FDC4A2CE3C1E7528D8BD030
                                                                                                                                                              SHA-512:B8584246498A5B8733F161FA51BD80F8FE5F71DFACFE537C2CF6D66FDE5E22E3AEE46D2735DFA81382AFDADE67CE4E9A4C26188727712D8A3F81E5757C04581B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.... ...h0.(^...}._"f.....Q.C..G{vU4)l..'VN0.m....>4.......l..U.f....d9o...J.L*.B..Q./P.@.&}......)i1SW..cRy.....!...Q.ZszL.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\WWWWWWWWWWW (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:GeoSwath RDF
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.637082584830295
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:WMNzk2IY4kiwrPxBWrhP/Hvp0vi9ucjgP6hNyeBNn:WM+2v4kiw9BWtnHvnvgihIMN
                                                                                                                                                              MD5:ACDE424F8BE99C17989D139626FE2976
                                                                                                                                                              SHA1:B2AA412E426DF9ECCA591E82C4C73978DD3767E2
                                                                                                                                                              SHA-256:0C2B7E572F3EF6710E2C921CA0C8797AEE53680D6FDC4A2CE3C1E7528D8BD030
                                                                                                                                                              SHA-512:B8584246498A5B8733F161FA51BD80F8FE5F71DFACFE537C2CF6D66FDE5E22E3AEE46D2735DFA81382AFDADE67CE4E9A4C26188727712D8A3F81E5757C04581B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.... ...h0.(^...}._"f.....Q.C..G{vU4)l..'VN0.m....>4.......l..U.f....d9o...J.L*.B..Q./P.@.&}......)i1SW..cRy.....!...Q.ZszL.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\XXXXXXXXXXX (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:GeoSwath RDF
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.637082584830295
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:WMNzk2IY4kiwrPxBWrhP/Hvp0vi9ucjgP6hNyeBNn:WM+2v4kiw9BWtnHvnvgihIMN
                                                                                                                                                              MD5:ACDE424F8BE99C17989D139626FE2976
                                                                                                                                                              SHA1:B2AA412E426DF9ECCA591E82C4C73978DD3767E2
                                                                                                                                                              SHA-256:0C2B7E572F3EF6710E2C921CA0C8797AEE53680D6FDC4A2CE3C1E7528D8BD030
                                                                                                                                                              SHA-512:B8584246498A5B8733F161FA51BD80F8FE5F71DFACFE537C2CF6D66FDE5E22E3AEE46D2735DFA81382AFDADE67CE4E9A4C26188727712D8A3F81E5757C04581B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.... ...h0.(^...}._"f.....Q.C..G{vU4)l..'VN0.m....>4.......l..U.f....d9o...J.L*.B..Q./P.@.&}......)i1SW..cRy.....!...Q.ZszL.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\YYYYYYYYYYY (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:GeoSwath RDF
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.637082584830295
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:WMNzk2IY4kiwrPxBWrhP/Hvp0vi9ucjgP6hNyeBNn:WM+2v4kiw9BWtnHvnvgihIMN
                                                                                                                                                              MD5:ACDE424F8BE99C17989D139626FE2976
                                                                                                                                                              SHA1:B2AA412E426DF9ECCA591E82C4C73978DD3767E2
                                                                                                                                                              SHA-256:0C2B7E572F3EF6710E2C921CA0C8797AEE53680D6FDC4A2CE3C1E7528D8BD030
                                                                                                                                                              SHA-512:B8584246498A5B8733F161FA51BD80F8FE5F71DFACFE537C2CF6D66FDE5E22E3AEE46D2735DFA81382AFDADE67CE4E9A4C26188727712D8A3F81E5757C04581B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.... ...h0.(^...}._"f.....Q.C..G{vU4)l..'VN0.m....>4.......l..U.f....d9o...J.L*.B..Q./P.@.&}......)i1SW..cRy.....!...Q.ZszL.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\ZZZZZZZZZZZ (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:GeoSwath RDF
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.637082584830295
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:WMNzk2IY4kiwrPxBWrhP/Hvp0vi9ucjgP6hNyeBNn:WM+2v4kiw9BWtnHvnvgihIMN
                                                                                                                                                              MD5:ACDE424F8BE99C17989D139626FE2976
                                                                                                                                                              SHA1:B2AA412E426DF9ECCA591E82C4C73978DD3767E2
                                                                                                                                                              SHA-256:0C2B7E572F3EF6710E2C921CA0C8797AEE53680D6FDC4A2CE3C1E7528D8BD030
                                                                                                                                                              SHA-512:B8584246498A5B8733F161FA51BD80F8FE5F71DFACFE537C2CF6D66FDE5E22E3AEE46D2735DFA81382AFDADE67CE4E9A4C26188727712D8A3F81E5757C04581B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.... ...h0.(^...}._"f.....Q.C..G{vU4)l..'VN0.m....>4.......l..U.f....d9o...J.L*.B..Q./P.@.&}......)i1SW..cRy.....!...Q.ZszL.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\desktop.ini

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:GeoSwath RDF
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.637082584830295
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:WMNzk2IY4kiwrPxBWrhP/Hvp0vi9ucjgP6hNyeBNn:WM+2v4kiw9BWtnHvnvgihIMN
                                                                                                                                                              MD5:ACDE424F8BE99C17989D139626FE2976
                                                                                                                                                              SHA1:B2AA412E426DF9ECCA591E82C4C73978DD3767E2
                                                                                                                                                              SHA-256:0C2B7E572F3EF6710E2C921CA0C8797AEE53680D6FDC4A2CE3C1E7528D8BD030
                                                                                                                                                              SHA-512:B8584246498A5B8733F161FA51BD80F8FE5F71DFACFE537C2CF6D66FDE5E22E3AEE46D2735DFA81382AFDADE67CE4E9A4C26188727712D8A3F81E5757C04581B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.... ...h0.(^...}._"f.....Q.C..G{vU4)l..'VN0.m....>4.......l..U.f....d9o...J.L*.B..Q./P.@.&}......)i1SW..cRy.....!...Q.ZszL.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\AAAAAAAAAAA (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.631230743728253
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:r45EE6xXBhuXDQopwzMmPePSP3OxJefZUmY3Y3ymS0wrW7Axn:rRruz5wzdhPWyZUgA0wr5x
                                                                                                                                                              MD5:A89FFB7322B5F00E8F9A0648F9F64965
                                                                                                                                                              SHA1:2F0D264DA1E464448E2E2F767D677DBE775A5359
                                                                                                                                                              SHA-256:195D7E3455ED273DAD9741CF36A3EC743FD591E794D6ECB3B451C12737EC092C
                                                                                                                                                              SHA-512:8C0E3BB1EE5C98FA912C642E7676291D1ED4A713912B69985C76B7CD438774B7DD93337364A9885EBBF2AF0F21EB830C5E3371C20D7C4110D5AB3C9FA48E7481
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.g}...HV.A..I..r...I...\.P.f........X/.....x.....+.BL*..,i.8...+...9.....*L.Q[...nm.<O...=......._..m).M.Kx,.....dS@(..s...=.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\BBBBBBBBBBB (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.631230743728253
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:r45EE6xXBhuXDQopwzMmPePSP3OxJefZUmY3Y3ymS0wrW7Axn:rRruz5wzdhPWyZUgA0wr5x
                                                                                                                                                              MD5:A89FFB7322B5F00E8F9A0648F9F64965
                                                                                                                                                              SHA1:2F0D264DA1E464448E2E2F767D677DBE775A5359
                                                                                                                                                              SHA-256:195D7E3455ED273DAD9741CF36A3EC743FD591E794D6ECB3B451C12737EC092C
                                                                                                                                                              SHA-512:8C0E3BB1EE5C98FA912C642E7676291D1ED4A713912B69985C76B7CD438774B7DD93337364A9885EBBF2AF0F21EB830C5E3371C20D7C4110D5AB3C9FA48E7481
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.g}...HV.A..I..r...I...\.P.f........X/.....x.....+.BL*..,i.8...+...9.....*L.Q[...nm.<O...=......._..m).M.Kx,.....dS@(..s...=.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\CCCCCCCCCCC (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.631230743728253
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:r45EE6xXBhuXDQopwzMmPePSP3OxJefZUmY3Y3ymS0wrW7Axn:rRruz5wzdhPWyZUgA0wr5x
                                                                                                                                                              MD5:A89FFB7322B5F00E8F9A0648F9F64965
                                                                                                                                                              SHA1:2F0D264DA1E464448E2E2F767D677DBE775A5359
                                                                                                                                                              SHA-256:195D7E3455ED273DAD9741CF36A3EC743FD591E794D6ECB3B451C12737EC092C
                                                                                                                                                              SHA-512:8C0E3BB1EE5C98FA912C642E7676291D1ED4A713912B69985C76B7CD438774B7DD93337364A9885EBBF2AF0F21EB830C5E3371C20D7C4110D5AB3C9FA48E7481
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.g}...HV.A..I..r...I...\.P.f........X/.....x.....+.BL*..,i.8...+...9.....*L.Q[...nm.<O...=......._..m).M.Kx,.....dS@(..s...=.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\DDDDDDDDDDD (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.631230743728253
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:r45EE6xXBhuXDQopwzMmPePSP3OxJefZUmY3Y3ymS0wrW7Axn:rRruz5wzdhPWyZUgA0wr5x
                                                                                                                                                              MD5:A89FFB7322B5F00E8F9A0648F9F64965
                                                                                                                                                              SHA1:2F0D264DA1E464448E2E2F767D677DBE775A5359
                                                                                                                                                              SHA-256:195D7E3455ED273DAD9741CF36A3EC743FD591E794D6ECB3B451C12737EC092C
                                                                                                                                                              SHA-512:8C0E3BB1EE5C98FA912C642E7676291D1ED4A713912B69985C76B7CD438774B7DD93337364A9885EBBF2AF0F21EB830C5E3371C20D7C4110D5AB3C9FA48E7481
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.g}...HV.A..I..r...I...\.P.f........X/.....x.....+.BL*..,i.8...+...9.....*L.Q[...nm.<O...=......._..m).M.Kx,.....dS@(..s...=.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\EEEEEEEEEEE (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.631230743728253
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:r45EE6xXBhuXDQopwzMmPePSP3OxJefZUmY3Y3ymS0wrW7Axn:rRruz5wzdhPWyZUgA0wr5x
                                                                                                                                                              MD5:A89FFB7322B5F00E8F9A0648F9F64965
                                                                                                                                                              SHA1:2F0D264DA1E464448E2E2F767D677DBE775A5359
                                                                                                                                                              SHA-256:195D7E3455ED273DAD9741CF36A3EC743FD591E794D6ECB3B451C12737EC092C
                                                                                                                                                              SHA-512:8C0E3BB1EE5C98FA912C642E7676291D1ED4A713912B69985C76B7CD438774B7DD93337364A9885EBBF2AF0F21EB830C5E3371C20D7C4110D5AB3C9FA48E7481
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.g}...HV.A..I..r...I...\.P.f........X/.....x.....+.BL*..,i.8...+...9.....*L.Q[...nm.<O...=......._..m).M.Kx,.....dS@(..s...=.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\FFFFFFFFFFF (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.631230743728253
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:r45EE6xXBhuXDQopwzMmPePSP3OxJefZUmY3Y3ymS0wrW7Axn:rRruz5wzdhPWyZUgA0wr5x
                                                                                                                                                              MD5:A89FFB7322B5F00E8F9A0648F9F64965
                                                                                                                                                              SHA1:2F0D264DA1E464448E2E2F767D677DBE775A5359
                                                                                                                                                              SHA-256:195D7E3455ED273DAD9741CF36A3EC743FD591E794D6ECB3B451C12737EC092C
                                                                                                                                                              SHA-512:8C0E3BB1EE5C98FA912C642E7676291D1ED4A713912B69985C76B7CD438774B7DD93337364A9885EBBF2AF0F21EB830C5E3371C20D7C4110D5AB3C9FA48E7481
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.g}...HV.A..I..r...I...\.P.f........X/.....x.....+.BL*..,i.8...+...9.....*L.Q[...nm.<O...=......._..m).M.Kx,.....dS@(..s...=.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\GGGGGGGGGGG (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.631230743728253
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:r45EE6xXBhuXDQopwzMmPePSP3OxJefZUmY3Y3ymS0wrW7Axn:rRruz5wzdhPWyZUgA0wr5x
                                                                                                                                                              MD5:A89FFB7322B5F00E8F9A0648F9F64965
                                                                                                                                                              SHA1:2F0D264DA1E464448E2E2F767D677DBE775A5359
                                                                                                                                                              SHA-256:195D7E3455ED273DAD9741CF36A3EC743FD591E794D6ECB3B451C12737EC092C
                                                                                                                                                              SHA-512:8C0E3BB1EE5C98FA912C642E7676291D1ED4A713912B69985C76B7CD438774B7DD93337364A9885EBBF2AF0F21EB830C5E3371C20D7C4110D5AB3C9FA48E7481
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.g}...HV.A..I..r...I...\.P.f........X/.....x.....+.BL*..,i.8...+...9.....*L.Q[...nm.<O...=......._..m).M.Kx,.....dS@(..s...=.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\HHHHHHHHHHH (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.631230743728253
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:r45EE6xXBhuXDQopwzMmPePSP3OxJefZUmY3Y3ymS0wrW7Axn:rRruz5wzdhPWyZUgA0wr5x
                                                                                                                                                              MD5:A89FFB7322B5F00E8F9A0648F9F64965
                                                                                                                                                              SHA1:2F0D264DA1E464448E2E2F767D677DBE775A5359
                                                                                                                                                              SHA-256:195D7E3455ED273DAD9741CF36A3EC743FD591E794D6ECB3B451C12737EC092C
                                                                                                                                                              SHA-512:8C0E3BB1EE5C98FA912C642E7676291D1ED4A713912B69985C76B7CD438774B7DD93337364A9885EBBF2AF0F21EB830C5E3371C20D7C4110D5AB3C9FA48E7481
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.g}...HV.A..I..r...I...\.P.f........X/.....x.....+.BL*..,i.8...+...9.....*L.Q[...nm.<O...=......._..m).M.Kx,.....dS@(..s...=.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\IIIIIIIIIII (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.631230743728253
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:r45EE6xXBhuXDQopwzMmPePSP3OxJefZUmY3Y3ymS0wrW7Axn:rRruz5wzdhPWyZUgA0wr5x
                                                                                                                                                              MD5:A89FFB7322B5F00E8F9A0648F9F64965
                                                                                                                                                              SHA1:2F0D264DA1E464448E2E2F767D677DBE775A5359
                                                                                                                                                              SHA-256:195D7E3455ED273DAD9741CF36A3EC743FD591E794D6ECB3B451C12737EC092C
                                                                                                                                                              SHA-512:8C0E3BB1EE5C98FA912C642E7676291D1ED4A713912B69985C76B7CD438774B7DD93337364A9885EBBF2AF0F21EB830C5E3371C20D7C4110D5AB3C9FA48E7481
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.g}...HV.A..I..r...I...\.P.f........X/.....x.....+.BL*..,i.8...+...9.....*L.Q[...nm.<O...=......._..m).M.Kx,.....dS@(..s...=.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\JJJJJJJJJJJ (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.631230743728253
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:r45EE6xXBhuXDQopwzMmPePSP3OxJefZUmY3Y3ymS0wrW7Axn:rRruz5wzdhPWyZUgA0wr5x
                                                                                                                                                              MD5:A89FFB7322B5F00E8F9A0648F9F64965
                                                                                                                                                              SHA1:2F0D264DA1E464448E2E2F767D677DBE775A5359
                                                                                                                                                              SHA-256:195D7E3455ED273DAD9741CF36A3EC743FD591E794D6ECB3B451C12737EC092C
                                                                                                                                                              SHA-512:8C0E3BB1EE5C98FA912C642E7676291D1ED4A713912B69985C76B7CD438774B7DD93337364A9885EBBF2AF0F21EB830C5E3371C20D7C4110D5AB3C9FA48E7481
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.g}...HV.A..I..r...I...\.P.f........X/.....x.....+.BL*..,i.8...+...9.....*L.Q[...nm.<O...=......._..m).M.Kx,.....dS@(..s...=.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\KKKKKKKKKKK (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.631230743728253
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:r45EE6xXBhuXDQopwzMmPePSP3OxJefZUmY3Y3ymS0wrW7Axn:rRruz5wzdhPWyZUgA0wr5x
                                                                                                                                                              MD5:A89FFB7322B5F00E8F9A0648F9F64965
                                                                                                                                                              SHA1:2F0D264DA1E464448E2E2F767D677DBE775A5359
                                                                                                                                                              SHA-256:195D7E3455ED273DAD9741CF36A3EC743FD591E794D6ECB3B451C12737EC092C
                                                                                                                                                              SHA-512:8C0E3BB1EE5C98FA912C642E7676291D1ED4A713912B69985C76B7CD438774B7DD93337364A9885EBBF2AF0F21EB830C5E3371C20D7C4110D5AB3C9FA48E7481
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.g}...HV.A..I..r...I...\.P.f........X/.....x.....+.BL*..,i.8...+...9.....*L.Q[...nm.<O...=......._..m).M.Kx,.....dS@(..s...=.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\LLLLLLLLLLL (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.631230743728253
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:r45EE6xXBhuXDQopwzMmPePSP3OxJefZUmY3Y3ymS0wrW7Axn:rRruz5wzdhPWyZUgA0wr5x
                                                                                                                                                              MD5:A89FFB7322B5F00E8F9A0648F9F64965
                                                                                                                                                              SHA1:2F0D264DA1E464448E2E2F767D677DBE775A5359
                                                                                                                                                              SHA-256:195D7E3455ED273DAD9741CF36A3EC743FD591E794D6ECB3B451C12737EC092C
                                                                                                                                                              SHA-512:8C0E3BB1EE5C98FA912C642E7676291D1ED4A713912B69985C76B7CD438774B7DD93337364A9885EBBF2AF0F21EB830C5E3371C20D7C4110D5AB3C9FA48E7481
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.g}...HV.A..I..r...I...\.P.f........X/.....x.....+.BL*..,i.8...+...9.....*L.Q[...nm.<O...=......._..m).M.Kx,.....dS@(..s...=.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\MMMMMMMMMMM (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.631230743728253
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:r45EE6xXBhuXDQopwzMmPePSP3OxJefZUmY3Y3ymS0wrW7Axn:rRruz5wzdhPWyZUgA0wr5x
                                                                                                                                                              MD5:A89FFB7322B5F00E8F9A0648F9F64965
                                                                                                                                                              SHA1:2F0D264DA1E464448E2E2F767D677DBE775A5359
                                                                                                                                                              SHA-256:195D7E3455ED273DAD9741CF36A3EC743FD591E794D6ECB3B451C12737EC092C
                                                                                                                                                              SHA-512:8C0E3BB1EE5C98FA912C642E7676291D1ED4A713912B69985C76B7CD438774B7DD93337364A9885EBBF2AF0F21EB830C5E3371C20D7C4110D5AB3C9FA48E7481
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.g}...HV.A..I..r...I...\.P.f........X/.....x.....+.BL*..,i.8...+...9.....*L.Q[...nm.<O...=......._..m).M.Kx,.....dS@(..s...=.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\NNNNNNNNNNN (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.631230743728253
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:r45EE6xXBhuXDQopwzMmPePSP3OxJefZUmY3Y3ymS0wrW7Axn:rRruz5wzdhPWyZUgA0wr5x
                                                                                                                                                              MD5:A89FFB7322B5F00E8F9A0648F9F64965
                                                                                                                                                              SHA1:2F0D264DA1E464448E2E2F767D677DBE775A5359
                                                                                                                                                              SHA-256:195D7E3455ED273DAD9741CF36A3EC743FD591E794D6ECB3B451C12737EC092C
                                                                                                                                                              SHA-512:8C0E3BB1EE5C98FA912C642E7676291D1ED4A713912B69985C76B7CD438774B7DD93337364A9885EBBF2AF0F21EB830C5E3371C20D7C4110D5AB3C9FA48E7481
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.g}...HV.A..I..r...I...\.P.f........X/.....x.....+.BL*..,i.8...+...9.....*L.Q[...nm.<O...=......._..m).M.Kx,.....dS@(..s...=.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\OOOOOOOOOOO (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.631230743728253
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:r45EE6xXBhuXDQopwzMmPePSP3OxJefZUmY3Y3ymS0wrW7Axn:rRruz5wzdhPWyZUgA0wr5x
                                                                                                                                                              MD5:A89FFB7322B5F00E8F9A0648F9F64965
                                                                                                                                                              SHA1:2F0D264DA1E464448E2E2F767D677DBE775A5359
                                                                                                                                                              SHA-256:195D7E3455ED273DAD9741CF36A3EC743FD591E794D6ECB3B451C12737EC092C
                                                                                                                                                              SHA-512:8C0E3BB1EE5C98FA912C642E7676291D1ED4A713912B69985C76B7CD438774B7DD93337364A9885EBBF2AF0F21EB830C5E3371C20D7C4110D5AB3C9FA48E7481
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.g}...HV.A..I..r...I...\.P.f........X/.....x.....+.BL*..,i.8...+...9.....*L.Q[...nm.<O...=......._..m).M.Kx,.....dS@(..s...=.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\PPPPPPPPPPP (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.631230743728253
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:r45EE6xXBhuXDQopwzMmPePSP3OxJefZUmY3Y3ymS0wrW7Axn:rRruz5wzdhPWyZUgA0wr5x
                                                                                                                                                              MD5:A89FFB7322B5F00E8F9A0648F9F64965
                                                                                                                                                              SHA1:2F0D264DA1E464448E2E2F767D677DBE775A5359
                                                                                                                                                              SHA-256:195D7E3455ED273DAD9741CF36A3EC743FD591E794D6ECB3B451C12737EC092C
                                                                                                                                                              SHA-512:8C0E3BB1EE5C98FA912C642E7676291D1ED4A713912B69985C76B7CD438774B7DD93337364A9885EBBF2AF0F21EB830C5E3371C20D7C4110D5AB3C9FA48E7481
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.g}...HV.A..I..r...I...\.P.f........X/.....x.....+.BL*..,i.8...+...9.....*L.Q[...nm.<O...=......._..m).M.Kx,.....dS@(..s...=.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\QQQQQQQQQQQ (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.631230743728253
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:r45EE6xXBhuXDQopwzMmPePSP3OxJefZUmY3Y3ymS0wrW7Axn:rRruz5wzdhPWyZUgA0wr5x
                                                                                                                                                              MD5:A89FFB7322B5F00E8F9A0648F9F64965
                                                                                                                                                              SHA1:2F0D264DA1E464448E2E2F767D677DBE775A5359
                                                                                                                                                              SHA-256:195D7E3455ED273DAD9741CF36A3EC743FD591E794D6ECB3B451C12737EC092C
                                                                                                                                                              SHA-512:8C0E3BB1EE5C98FA912C642E7676291D1ED4A713912B69985C76B7CD438774B7DD93337364A9885EBBF2AF0F21EB830C5E3371C20D7C4110D5AB3C9FA48E7481
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.g}...HV.A..I..r...I...\.P.f........X/.....x.....+.BL*..,i.8...+...9.....*L.Q[...nm.<O...=......._..m).M.Kx,.....dS@(..s...=.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\RRRRRRRRRRR (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.631230743728253
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:r45EE6xXBhuXDQopwzMmPePSP3OxJefZUmY3Y3ymS0wrW7Axn:rRruz5wzdhPWyZUgA0wr5x
                                                                                                                                                              MD5:A89FFB7322B5F00E8F9A0648F9F64965
                                                                                                                                                              SHA1:2F0D264DA1E464448E2E2F767D677DBE775A5359
                                                                                                                                                              SHA-256:195D7E3455ED273DAD9741CF36A3EC743FD591E794D6ECB3B451C12737EC092C
                                                                                                                                                              SHA-512:8C0E3BB1EE5C98FA912C642E7676291D1ED4A713912B69985C76B7CD438774B7DD93337364A9885EBBF2AF0F21EB830C5E3371C20D7C4110D5AB3C9FA48E7481
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.g}...HV.A..I..r...I...\.P.f........X/.....x.....+.BL*..,i.8...+...9.....*L.Q[...nm.<O...=......._..m).M.Kx,.....dS@(..s...=.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\SSSSSSSSSSS (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.631230743728253
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:r45EE6xXBhuXDQopwzMmPePSP3OxJefZUmY3Y3ymS0wrW7Axn:rRruz5wzdhPWyZUgA0wr5x
                                                                                                                                                              MD5:A89FFB7322B5F00E8F9A0648F9F64965
                                                                                                                                                              SHA1:2F0D264DA1E464448E2E2F767D677DBE775A5359
                                                                                                                                                              SHA-256:195D7E3455ED273DAD9741CF36A3EC743FD591E794D6ECB3B451C12737EC092C
                                                                                                                                                              SHA-512:8C0E3BB1EE5C98FA912C642E7676291D1ED4A713912B69985C76B7CD438774B7DD93337364A9885EBBF2AF0F21EB830C5E3371C20D7C4110D5AB3C9FA48E7481
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.g}...HV.A..I..r...I...\.P.f........X/.....x.....+.BL*..,i.8...+...9.....*L.Q[...nm.<O...=......._..m).M.Kx,.....dS@(..s...=.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\TTTTTTTTTTT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.631230743728253
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:r45EE6xXBhuXDQopwzMmPePSP3OxJefZUmY3Y3ymS0wrW7Axn:rRruz5wzdhPWyZUgA0wr5x
                                                                                                                                                              MD5:A89FFB7322B5F00E8F9A0648F9F64965
                                                                                                                                                              SHA1:2F0D264DA1E464448E2E2F767D677DBE775A5359
                                                                                                                                                              SHA-256:195D7E3455ED273DAD9741CF36A3EC743FD591E794D6ECB3B451C12737EC092C
                                                                                                                                                              SHA-512:8C0E3BB1EE5C98FA912C642E7676291D1ED4A713912B69985C76B7CD438774B7DD93337364A9885EBBF2AF0F21EB830C5E3371C20D7C4110D5AB3C9FA48E7481
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.g}...HV.A..I..r...I...\.P.f........X/.....x.....+.BL*..,i.8...+...9.....*L.Q[...nm.<O...=......._..m).M.Kx,.....dS@(..s...=.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\UUUUUUUUUUU (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.631230743728253
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:r45EE6xXBhuXDQopwzMmPePSP3OxJefZUmY3Y3ymS0wrW7Axn:rRruz5wzdhPWyZUgA0wr5x
                                                                                                                                                              MD5:A89FFB7322B5F00E8F9A0648F9F64965
                                                                                                                                                              SHA1:2F0D264DA1E464448E2E2F767D677DBE775A5359
                                                                                                                                                              SHA-256:195D7E3455ED273DAD9741CF36A3EC743FD591E794D6ECB3B451C12737EC092C
                                                                                                                                                              SHA-512:8C0E3BB1EE5C98FA912C642E7676291D1ED4A713912B69985C76B7CD438774B7DD93337364A9885EBBF2AF0F21EB830C5E3371C20D7C4110D5AB3C9FA48E7481
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.g}...HV.A..I..r...I...\.P.f........X/.....x.....+.BL*..,i.8...+...9.....*L.Q[...nm.<O...=......._..m).M.Kx,.....dS@(..s...=.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\VVVVVVVVVVV (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.631230743728253
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:r45EE6xXBhuXDQopwzMmPePSP3OxJefZUmY3Y3ymS0wrW7Axn:rRruz5wzdhPWyZUgA0wr5x
                                                                                                                                                              MD5:A89FFB7322B5F00E8F9A0648F9F64965
                                                                                                                                                              SHA1:2F0D264DA1E464448E2E2F767D677DBE775A5359
                                                                                                                                                              SHA-256:195D7E3455ED273DAD9741CF36A3EC743FD591E794D6ECB3B451C12737EC092C
                                                                                                                                                              SHA-512:8C0E3BB1EE5C98FA912C642E7676291D1ED4A713912B69985C76B7CD438774B7DD93337364A9885EBBF2AF0F21EB830C5E3371C20D7C4110D5AB3C9FA48E7481
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.g}...HV.A..I..r...I...\.P.f........X/.....x.....+.BL*..,i.8...+...9.....*L.Q[...nm.<O...=......._..m).M.Kx,.....dS@(..s...=.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\WWWWWWWWWWW (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.631230743728253
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:r45EE6xXBhuXDQopwzMmPePSP3OxJefZUmY3Y3ymS0wrW7Axn:rRruz5wzdhPWyZUgA0wr5x
                                                                                                                                                              MD5:A89FFB7322B5F00E8F9A0648F9F64965
                                                                                                                                                              SHA1:2F0D264DA1E464448E2E2F767D677DBE775A5359
                                                                                                                                                              SHA-256:195D7E3455ED273DAD9741CF36A3EC743FD591E794D6ECB3B451C12737EC092C
                                                                                                                                                              SHA-512:8C0E3BB1EE5C98FA912C642E7676291D1ED4A713912B69985C76B7CD438774B7DD93337364A9885EBBF2AF0F21EB830C5E3371C20D7C4110D5AB3C9FA48E7481
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.g}...HV.A..I..r...I...\.P.f........X/.....x.....+.BL*..,i.8...+...9.....*L.Q[...nm.<O...=......._..m).M.Kx,.....dS@(..s...=.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\XXXXXXXXXXX (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.631230743728253
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:r45EE6xXBhuXDQopwzMmPePSP3OxJefZUmY3Y3ymS0wrW7Axn:rRruz5wzdhPWyZUgA0wr5x
                                                                                                                                                              MD5:A89FFB7322B5F00E8F9A0648F9F64965
                                                                                                                                                              SHA1:2F0D264DA1E464448E2E2F767D677DBE775A5359
                                                                                                                                                              SHA-256:195D7E3455ED273DAD9741CF36A3EC743FD591E794D6ECB3B451C12737EC092C
                                                                                                                                                              SHA-512:8C0E3BB1EE5C98FA912C642E7676291D1ED4A713912B69985C76B7CD438774B7DD93337364A9885EBBF2AF0F21EB830C5E3371C20D7C4110D5AB3C9FA48E7481
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.g}...HV.A..I..r...I...\.P.f........X/.....x.....+.BL*..,i.8...+...9.....*L.Q[...nm.<O...=......._..m).M.Kx,.....dS@(..s...=.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\YYYYYYYYYYY (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.631230743728253
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:r45EE6xXBhuXDQopwzMmPePSP3OxJefZUmY3Y3ymS0wrW7Axn:rRruz5wzdhPWyZUgA0wr5x
                                                                                                                                                              MD5:A89FFB7322B5F00E8F9A0648F9F64965
                                                                                                                                                              SHA1:2F0D264DA1E464448E2E2F767D677DBE775A5359
                                                                                                                                                              SHA-256:195D7E3455ED273DAD9741CF36A3EC743FD591E794D6ECB3B451C12737EC092C
                                                                                                                                                              SHA-512:8C0E3BB1EE5C98FA912C642E7676291D1ED4A713912B69985C76B7CD438774B7DD93337364A9885EBBF2AF0F21EB830C5E3371C20D7C4110D5AB3C9FA48E7481
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.g}...HV.A..I..r...I...\.P.f........X/.....x.....+.BL*..,i.8...+...9.....*L.Q[...nm.<O...=......._..m).M.Kx,.....dS@(..s...=.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\ZZZZZZZZZZZ (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.631230743728253
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:r45EE6xXBhuXDQopwzMmPePSP3OxJefZUmY3Y3ymS0wrW7Axn:rRruz5wzdhPWyZUgA0wr5x
                                                                                                                                                              MD5:A89FFB7322B5F00E8F9A0648F9F64965
                                                                                                                                                              SHA1:2F0D264DA1E464448E2E2F767D677DBE775A5359
                                                                                                                                                              SHA-256:195D7E3455ED273DAD9741CF36A3EC743FD591E794D6ECB3B451C12737EC092C
                                                                                                                                                              SHA-512:8C0E3BB1EE5C98FA912C642E7676291D1ED4A713912B69985C76B7CD438774B7DD93337364A9885EBBF2AF0F21EB830C5E3371C20D7C4110D5AB3C9FA48E7481
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.g}...HV.A..I..r...I...\.P.f........X/.....x.....+.BL*..,i.8...+...9.....*L.Q[...nm.<O...=......._..m).M.Kx,.....dS@(..s...=.

                                                                                                                                                              C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\desktop.ini

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129
                                                                                                                                                              Entropy (8bit):6.631230743728253
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:r45EE6xXBhuXDQopwzMmPePSP3OxJefZUmY3Y3ymS0wrW7Axn:rRruz5wzdhPWyZUgA0wr5x
                                                                                                                                                              MD5:A89FFB7322B5F00E8F9A0648F9F64965
                                                                                                                                                              SHA1:2F0D264DA1E464448E2E2F767D677DBE775A5359
                                                                                                                                                              SHA-256:195D7E3455ED273DAD9741CF36A3EC743FD591E794D6ECB3B451C12737EC092C
                                                                                                                                                              SHA-512:8C0E3BB1EE5C98FA912C642E7676291D1ED4A713912B69985C76B7CD438774B7DD93337364A9885EBBF2AF0F21EB830C5E3371C20D7C4110D5AB3C9FA48E7481
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.g}...HV.A..I..r...I...\.P.f........X/.....x.....+.BL*..,i.8...+...9.....*L.Q[...nm.<O...=......._..m).M.Kx,.....dS@(..s...=.

                                                                                                                                                              C:\$WinREAgent\Scratch\jC7CNxlVt.README.txt (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\ProgramData\jC7CNxlVt.ico

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):15086
                                                                                                                                                              Entropy (8bit):4.262047636092361
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:jpBaAlHSa2vU9G/8MMBD7O1lXFMB8VMJP7:jpjmkMYD7IFMRx7
                                                                                                                                                              MD5:88D9337C4C9CFE2D9AFF8A2C718EC76B
                                                                                                                                                              SHA1:CE9F87183A1148816A1F777BA60A08EF5CA0D203
                                                                                                                                                              SHA-256:95E059EF72686460884B9AEA5C292C22917F75D56FE737D43BE440F82034F438
                                                                                                                                                              SHA-512:ABAFEA8CA4E85F47BEFB5AA3EFEE9EEE699EA87786FAFF39EE712AE498438D19A06BB31289643B620CB8203555EA4E2B546EF2F10D3F0087733BC0CEACCBEAFD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\.curlrc.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):239
                                                                                                                                                              Entropy (8bit):7.05014165094121
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:h6dEBy4pRAbO6x8dINY2ajcgsScMMUnK9Y240pD:sdmrpG0Ga93O
                                                                                                                                                              MD5:0691B41E3DB87516ECB217811D7F8681
                                                                                                                                                              SHA1:591652A55074B7C326E46F8A264A65EBC621CF14
                                                                                                                                                              SHA-256:909349A1E49006AA40C9A008FC985C9A233C5D096AB657E2D15D422C3FF231F6
                                                                                                                                                              SHA-512:3D1E4842525CEDE9F2F94CD4818D48694FB899FF543B52136EE3465962B407E362F9DEB12C6D6B65EF2302B0AC67064E5DB61E3A1317093405493743BF58EC02
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.%.\}c..d9..1..........K..y&...`t... .$9^lv..l...L.Q..C...o.Vl.../#.....N..mY....).....).r.TH.. ..A....a..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\CURRENT.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):248
                                                                                                                                                              Entropy (8bit):7.152047306326843
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:ytjhtE4oCkZIwi9Dn7+EFyKcgsScMMUnK9Y240pD:aE4MXS6Egc3O
                                                                                                                                                              MD5:B969EEF57CAD9C724D9C590FA3A7DD19
                                                                                                                                                              SHA1:EEFCEC388413BF142E4C38650BFB5154DE320FB8
                                                                                                                                                              SHA-256:C52423A320055519C26F86C50D7A41E4B2B733B5041C3B739C0D12C39973FC17
                                                                                                                                                              SHA-512:5D00CDC740CFECA78660AF760EA9FC1722CEAEC54CA7E7DC4FADBC05B722BB5520DA9AFC752D3B44A163ABA8B2E96CA9027AA1ED0B6FA9E255AED0A706C68CF7
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:>..8}.g,..5.i.kj.9......l<._....K.-+&...cw...#.$.%......'"+.jc'.j.^......}\*.....|N.....0..k...P.....+..O.~r.b..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:OpenPGP Public Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):458
                                                                                                                                                              Entropy (8bit):7.512119893341717
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:rzZ8vFoHtU/QbENYx7WZWRNDTymbPZsEc3O:rzZ8vnbK7SWTnFhPc+
                                                                                                                                                              MD5:7EC919580F43C1CFFC736A44D41A9BD0
                                                                                                                                                              SHA1:1E19B9542EDBB17EC116C49739239344BBAD5BFC
                                                                                                                                                              SHA-256:01C3A3FF9D0953A6929F762BC502AE8EA3F35BA0AD81E3FED48CE5232421B9C4
                                                                                                                                                              SHA-512:DF1AA315406DA220D27E885827A5414170C0659E90185C484ECA180AA9A9DFC199A937CB3CF32AF5B9C7CADB9A49E496F97CF54D823A56475CC802D40B0D226D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.+..I.."...|.Q...*..b....4....7p.........R....;|......}.`.}.......|>.....$Q.i1.[QTJ\.........<.s....&+.7.<..U.#...F..O ...k.%.y.y2.@%..nL.;opD...y..5I.X.Hn....KB...-.C.-.O.=..1.....|...7%2.}].r...z9..w..[.....A.....y..e..YS".$.t..i..xt.I.w>.....l.._.+3..y.....l..c..8.....c.v........Cz.....J..4....E...ns..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\076dd576a8178299_0.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):466
                                                                                                                                                              Entropy (8bit):7.556012627548821
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:Tv8DzHL1WIyKc7xlUI1BWt1TC5lpz0IA0VtehCfpLYx6QQnhwnFVozXOpnKcgsSG:rUHL1OJ7UIXWQzwIAetvpLoE3O
                                                                                                                                                              MD5:D02187A5D1D183043BBDD457F46FD89A
                                                                                                                                                              SHA1:61B1F42A8F26C098D6359931EFC0FE4E82D48341
                                                                                                                                                              SHA-256:F364A7CFC1D94DE5B2FA4E9394619AE69F0A8C1FE05C6FE95F2E2495E9B12443
                                                                                                                                                              SHA-512:43636E33643EDCF6CD0E29EF82FB9779DB336B7D4A8A92C09D33C836626B80E270CE88D1B58C7D544A0ACF122110D204EE1237781AD386943C1216DFAC51CAA0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:\F.....h^..O.S....Y..|Q&.........].Xa...p.%..w,..IN/.u.WqHY...n\N....F....b..Z>.E.O...i...}.+9S.#.E.....\..zL..F7.e.+tm&\9.3.l:.....(.y..I...x.o.HcDC.......vM..!.7...../*|....a...Y..'..J..I.P:.............Q.`.z9..r..gG.......,......J.0...>.$.&..i..xt.J.w=nK..V.`.y....=..DW..6......~.0...Y.........x...#.......j...MU`p..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):420
                                                                                                                                                              Entropy (8bit):7.446069179608292
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:dVPAoDEUC14mxOT3wvLJko207X6mhPioLqiVq+cgsScMMUnK9Y240pD:dxTEimxOT3o9kY6poGAqg3O
                                                                                                                                                              MD5:7284B98130C07AE7B04693116BA17ECD
                                                                                                                                                              SHA1:CA2806BAAE6294761CBF9654C76E4F672B9D2C36
                                                                                                                                                              SHA-256:DB3BB9384BFB6F91776532DFD8CB312978B128648FB93738B4BDDD1A15F8A504
                                                                                                                                                              SHA-512:D7AA825C9D342DB6AE819CFF939B320ABFD72FC5660BD14F87847E0DCCE3C004A8D2737E404ABD2E1C3CC8D824315B571931FE988283806D90ECACCB57B70F80
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:`.A...4.Lf..P.....#..0..j.]x...z.,Xe5X..k....Fi.3.d>dL..7..3.......j..\~T...Ok......Q=....{s...;.]k..F...Y.......#J`....o@.?=w[..Oo......6......a{d3.e. Y..,.-.Sn~.f....z9..|..........[r.ly0..cn...r.$.t..i..xt.....t....V....S.... ...Q...6.}.i.bk........W......b}..$./_ks.l..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):498
                                                                                                                                                              Entropy (8bit):7.584554626020027
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:jKgMOcZcDSl6zQWL+EevDCSX5LJYWsu3O:jRcZ2qgQqerL/+
                                                                                                                                                              MD5:30CCB10599F9AD983B15DF1D29054B85
                                                                                                                                                              SHA1:743BFEB9C358CA0034E1189563F5FA9A38A8FD17
                                                                                                                                                              SHA-256:563B88796FEA902367C134F980AC4FDA231340DEBFCE4650A2E0FCFC54E5A690
                                                                                                                                                              SHA-512:8F499229C4C48E62D723F6E29CE5B4658B1D465577FE4D99DC7905646AAE7B8D1D261810D227219AAD2D00B10A774869D039442E30CF13ADE45AA74CA0D5E37F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..`......M.....)..b:.'......l.........X...0.B...S..F........'Q.2....7d..Zp!..7-...$I..Rt..R..V.c.....ZJ..Lc6Q....P.S.t.r.4Bv,..".~...;_.G....ud*@....r.`....~G.a.0g.8..z.....s..H.R..5.Y.....(.{.............ym$..F[..~g.Stx ...."....9.N.(zz9..A..-l..8..ZG....).$[+.......t...i..xw.I.t=....../.......R.V...59.OG......)1....>....j\LW.(=...!..z..0..};=r..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0a71ed411241f66a_0.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):445
                                                                                                                                                              Entropy (8bit):7.487458303514744
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:qewDR2Lge/6qEReExurnhE0drutSyeG//HVY5hfjIVII2JqnKcgsScMMUnK9Y240:LqM6/ju1E4reeq/HG5hfsaIxc3O
                                                                                                                                                              MD5:E588A5B746A51D5234CEFFAC79BED04F
                                                                                                                                                              SHA1:659C45E95F0DB9901C0B0AAFC03854271A1A72EA
                                                                                                                                                              SHA-256:A78C0EA2E8FDA3DA1DCAF91CC6BBC41E765FD4C1AF3E7F191029C8E26C6242C7
                                                                                                                                                              SHA-512:F3712EEA8D1C7794B3BDD142DF27490B00DE31922D6AA98310E281D8C4DB6A1E2155D2AB73E72905D44E7FF17EEDF7AC6A543BDE538B3881ABC4AE97A50A9A5B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:!.f+.[.e.@......I.....)}]+.....wI.......M..c....s;T.......&@.....!...k....!.N...\.....B@}.....S.l........kLf!....l@......5.8SH..S.W..;...S...i....!....:...s.R.R.tJ..T.@!Q.z....W.w.k.....WPrz9..s.......>....K..z.-<y.2. .$.t...i..{t.I.w=.......:.2.......ZQY...3.....*z..2.pZ.=.0.!.W*ad..d...2..<q..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0b05805acd0d1882_0.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):442
                                                                                                                                                              Entropy (8bit):7.500028883189904
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:fp26PytaoTVm4vqZ+oxZBSM0iWZT8L5Ml9blHvnMNYAipKI20EKcgsScMMUnK9YO:XywOYXBSM6ZTa5MlnvNAiz20j3O
                                                                                                                                                              MD5:AB98E5A58591A9601DE02CF17A04ED8D
                                                                                                                                                              SHA1:81558CBA463A2AE4B760A1296C005F7D06A05D85
                                                                                                                                                              SHA-256:EF8E27D42FFFB116E03392700AC899E25A4E202471E5DF23BE9224C2B0399EFC
                                                                                                                                                              SHA-512:F3C10734AD1532D3311CCC7016CDC6DF76E87F4F76BA52DF801DA4794F46BDA122F67799CBB8223B4EF0DE9C68ECB0313E7A336B7B896054E37D98C687FAC5FE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..7.o(.....S...y..yD..$.........s1..L...6><...o..n....{.H..&.u....O..,...1......Htk.].>`._....d.y..@cTY.$Tkn.?.y..uv9i.|lu..;...Q.+u.R......K.lC.(....2RC.J.m.8p.:..3..B...[..Y....$$.z9...1.\Zt.j...C..\"/GJ.i...>.$.&..i..xt.J.w=.ne...U.....uR....hD.+R[...z.9}......rb..mX/...H.g.%7.!...oDp..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):461
                                                                                                                                                              Entropy (8bit):7.553445521783988
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:E+AvUNF6uMA6ctnK19Qchfhvi/ONtltc3O:E+Y4dH6co1iQZjY+
                                                                                                                                                              MD5:B3DFFF24131A6DA16CAB88CF615CFA20
                                                                                                                                                              SHA1:491996404B17D87D472AA757746375E26DF323A8
                                                                                                                                                              SHA-256:1B8A5699817BC83559F830A110BED630E6BA323690D956972A8FF11A6E5BCB41
                                                                                                                                                              SHA-512:C69C458B6CBBE54F2EC4333A3FA1AF720CCBD9D5EA48CF4BA471F99D17A9C62C3BFDAFED5D48F424458F239BDF1B2F7D43358FF2E3E73B90CC2DF90438F15BFB
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....Mz...Q.....e.......\.G....\)....t........O=...W..*..e&..;v.......]..e.5.7Px..h...l.K..1..\`.G.....~.....[....Nj1..J..h...L"..k...Z..t.!..s.9?.B.D....t.L!&s......7.[1.....<.l..;..ZS.=.D9.J...}.z9..v...b.......F.~kD%.pU+... .$.t...i..{t.I.w=.~.Dg_6[..=..V.Y..u..h(..7...).p..2.S.Z..4..z.....D.i..LI7?...q..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\the-real-index.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):291
                                                                                                                                                              Entropy (8bit):7.278165248250445
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:mrdCDDEwi42jeT5foz8/cgsScMMUnK9Y240pD:mdCfVyjeT5v3O
                                                                                                                                                              MD5:4C5881B8B025605A71AC2997F8D38453
                                                                                                                                                              SHA1:B44A090D1A5D901AEEEC2ACA54FDE2A7BB5E900E
                                                                                                                                                              SHA-256:F4A5EF3B70F8AEDE7777DC01C1350396D8539E122E4F54F0E7B4742FBCB086B7
                                                                                                                                                              SHA-512:1B95E564E81904D290D25AD8E8AC00297304D4A01908BB1F8D75AF049E305870BB2729FF59FCBDF1D50D38341ED75768E7D4FE8FF2041BCD3FCEB52C541A4259
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..}.g?.Qp`.c......o.3..!...?...@..( .`.......{.>9..!.....j...k%.I.;e..ct... .$.t..i..{t.I...np...S...].%.W?..^...4..g.....b..8.I...AF.n..]{.......-...m..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):253
                                                                                                                                                              Entropy (8bit):7.238709928355165
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:ArSAYDfysTDRaVcp6W+/mcgsScMMUnK9Y240pD:wSjDfysT8WPH3O
                                                                                                                                                              MD5:31946470933E87B96470FDB761C50D9B
                                                                                                                                                              SHA1:D0AD9025EF78E817A45AC129B5DE7BAA6AF34DA2
                                                                                                                                                              SHA-256:4A0F80A43A4B6E6FBD3DBA371064F9F44AF59D650C3A6AB77D43583FE5D9F696
                                                                                                                                                              SHA-512:FEA945866038A997595DB6826AC662CFD341D1DABE08B7E45AF4A28F53946ADE807B66FF8C0FDE94176B5FD3090AC1ADB7A1D8476AD8678EB46599A7E4C83902
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:5J.!.....C@....{......#9.. ....).......-y&...ct... .t.8.M...,.a.{.%..IZ......$s.R.....w..|!....E..T.i.-.T8$.....q._..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):517
                                                                                                                                                              Entropy (8bit):7.620061841007441
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:MLbyAcSTRBiw2POn3q5jT4F55Z0exm/Lka7cj1oc3O:MWAcKo2K4PHxm/oUcac+
                                                                                                                                                              MD5:044F830A5387BDA3288EA1869030A547
                                                                                                                                                              SHA1:FDF1556C716DC8A83A3A0ED657B22C773CD44393
                                                                                                                                                              SHA-256:07B5BE65092E79238AAE88FD38B4080E788A92AE78D5765A93766E4CD5307593
                                                                                                                                                              SHA-512:CBA11FCE023FA883049AFBA75DE90A6E8546A76ABB8B16269F6CF4FE866E6EEABAA101A81E1D92BF327C0E7DD30482C519AB22EE04078F1094DBB17ED0891983
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:e..[2.+.n.b.f.Gg..9..?P..>9....."..p..hi..:.G..O6r.>~...I;'......8......^.......BQ.U[.....:<R..........y`.[5......`K.aI..31.A..9n ....N.'.. .........M.7rDQ!d[...'H.O............1....8?|. .p.......~ON9......3..[.A.S...B.f....f.-.W...=....M..M..o.......\.H...[c.r-.b<.%.i....x.?P/.9....0Kb{.....K..y&...ct.vX.E\.7~.Jxz.#Ng.l.Y....!....oS! ..<S^s< k.......{2./`..Lb.#[..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):525
                                                                                                                                                              Entropy (8bit):7.612397526479215
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:cXGZ2pd9Cfjt9Y8JGj3Vsww9AvsCRlgRTd63O:cWw3Mfjtq8J0oqRfgJo+
                                                                                                                                                              MD5:E1E3CB7BD3EC295A51E1C3915A9C82AC
                                                                                                                                                              SHA1:5B5A9B0FD1F93593A2C6DF23A7E4ED6E2C8327C9
                                                                                                                                                              SHA-256:7D3AF963EF220B030C46330F3BC04649E2392E2621E1F66C283BFE759A12356C
                                                                                                                                                              SHA-512:22126D0197E4312E92F28E98C432D8203F9806A45F533C114D57AB817BA2C8BB917CE8A6161D93708EAAA8E872255D59D68D4A331792A80CBC9AEE62CEB18020
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:Ap...0.?..`.R.%.F.f7&...If.$f`'.%.....cm!.7E....k....ydQ.j3.........+7l.......*....\....t.;4.._...|.................ck.A.=.)..=..RR.M..u..m.(.l.|)...Y.....p..4..M..8\-9.....FF.C7.7j...z.$F-...-^.J.|b.n#.@.<..6.....;.^S.1Agl.I+.i....R.]......z.....g..;I...K.oY...-,.P..b..[..9..........|..Z.-yt...ct... .$.tt...m.T....Wfrr|et5...."..@*....3n.^.&...h.1...:G..G...Fc..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\CURRENT.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:PGP Secret Sub-key -
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):248
                                                                                                                                                              Entropy (8bit):7.185932903076472
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:PPxP92XhtE4amxTOFKcgsScMMUnK9Y240pD:PJF2XE4aETOy3O
                                                                                                                                                              MD5:9A6783DCFA6F8A7D447E3871F2065C42
                                                                                                                                                              SHA1:7C31EF15DE0919ADE3A30CC34EA3F37D732DA6CB
                                                                                                                                                              SHA-256:C2A665FFA24672A0C76F91AA8465D77C223522441730451C535CE39CF4E7365C
                                                                                                                                                              SHA-512:B7B8907E8DD06BA1909C8EADCA70C9C401F472E66F7EBFC7A4D5581686AF783003F6FFC9F3F7A97B3435779649BB8D0671338CA9B04DEB21647094D5455432F7
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.......X..[.T...9......l<._....K.-+&...cw...#.$......BV..F_......z,f`&.G..,....m........N...[r.......Q.@c.1b..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):561
                                                                                                                                                              Entropy (8bit):7.637366399320334
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:oMFkpjjBHmIP2v64E2asWB69yYhMa5ZBoMc3O:Apjl9SE2arbYhMaJNc+
                                                                                                                                                              MD5:00CB68CF19EBA39B93E70B48CC2E89FA
                                                                                                                                                              SHA1:A65DC4CA96FD571A3052FF44AF319113E1B45795
                                                                                                                                                              SHA-256:A60266DFABC5FD8820A3C7DA2461BFA946A444ADC3D11FB6AB6BBCE0AD06A844
                                                                                                                                                              SHA-512:61BB0368E098476349DF5CD9AD5D99CE41A33138CE67E63D0ED2EC04C3B449BD81932F641C42273B2DB44B988731785584468E2851EC3A9B6583AD16535A0A17
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:...f.M..o...#..}....B.r2...nq.hJ.5.Tae8g.X.p.fL..../>......L;8...S..5?.@qD.o..TC&....EK..j...Cp.r...2%z....c...\S..:/.p@..,.7.|S.K...Z..w1....IS.uV.\...(...P...4y...=....jX..L......qr....o.g.uc.....T...t...n.....1...IgE.=E.U.e...ra..N..N[a.....%.h.Mi..0.@QPt|~Y.d._6CV.D.+^M.wQ..zK..~b..0.&...7k.5.A..HO.....9....0Kb{.....K..y&...ct.,....7.f0_...p.L.....O.9..Eq[.%D(G.~S....T...Y5..../.GS.u..w[..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:OpenPGP Public Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):569
                                                                                                                                                              Entropy (8bit):7.61903649918231
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:QZLEzWg9PuZ0COk3vTJB5SVw2JKRlN/tfPcgwJX3O:QGzdE6KvTPuZART/xRsX+
                                                                                                                                                              MD5:BC47B3D0D623690A7FAB1CA52F91D611
                                                                                                                                                              SHA1:90C5972D715E7A3C8F7C13E8606B787632893D89
                                                                                                                                                              SHA-256:B125E6BC14E868AB826ACA5728BBFE58B70EFAE27F7FFDE55AD3D575C48E734E
                                                                                                                                                              SHA-512:113E21191406FC3C0AC49A02ADEC7A68B0A348B24CF4611B2F6B6D894F95273BD2E373CE0750942F24046B5536FCB09C0A805C478A1AA051FC2C47E125429363
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.UY2o_JPZ....r5..X/.>...~......B.qlT.|...<....l.rf.~/.[8..u..9>...KU...%.1.\..8.....S.i@.....5N.........'...n...}.ll...8..2.{.$+....U........ZX...G./..d....Y.co.A.e.."P>;q?".n2.J...i...6.B. c..C....<...f.x.)..r.D......T.&....3..d.y.....d.......V...|..Z.^N..{.sL.=..N.....#..h.......\.t..m...zfp....."..n....?J"....:....9..........|..Z.-yt...ct... .$.t.....w.h4}>.L...J:.G..J..D.d..g)....:.X].....Z...cIF.........>c..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\MANIFEST-000001.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):283
                                                                                                                                                              Entropy (8bit):7.219828064293493
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:0FwXmY1du50idb3joavJ5i9a7w7NmG8LyNqVaUDv+cqymokUD+tzwMFSUNnKeGgI:0Vbvi9tmz/aUDv+cgsScMMUnK9Y240pD
                                                                                                                                                              MD5:82ED1340170EFBF4D1315AFF3BCBB0C0
                                                                                                                                                              SHA1:BA9560924EFC036887EFEDE13E190DB816C627C1
                                                                                                                                                              SHA-256:B082B0461C95E78D6208755A541994C3F2F93869E08892E6BC60FD4B3266C47E
                                                                                                                                                              SHA-512:8C1855B950CD5515218F92CCA4C52715FD7B742F089104F69A1CB73E7DE3C87879ED947146BF2D254D2D60A3DD26F252F0B3BBE4429FD09E450DE908DA0E1A31
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..zoy6D.r._.C4..;.>.(..D.....-PO.YnV...4n.9.....$.....`...{V,..cn...r.$.t..i..xt..#\.........9_....:..c...l.\.3>.h...J...6*Rs.......T8M0.~...1..l..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):731
                                                                                                                                                              Entropy (8bit):7.708208053798743
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:TXkLVl4XKy677p8BOP6L+zQn3uOoNsYvGx6JgT9eeKl6THhfWDgiPmmzc3O:TXk00l5P6LuoUGxagpeHwBOBPpY+
                                                                                                                                                              MD5:211A0A8F45747547729F82B4E3CE7989
                                                                                                                                                              SHA1:32D18BD763BF75EC3C2906B795F925B5BE5AAC23
                                                                                                                                                              SHA-256:70719C600C0CF92C20439C16E314CA70D33BAEB66634E826FEF0B4AC01B12EB5
                                                                                                                                                              SHA-512:A099B54C9E7873278507256C9FB6CF39B1B3CCF170DDE8D769CA313F0A4C2B9D3DD73FED8E9F7DFC03036B0E4A0A8276CE031D2CD84BA955FC6FAFCC20E169DF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:3.<.I.}+4d...&.q..K~.....6...[(.]..P....)/....i.M....V..,......hA..f.m..q.xp.~....L..F..o..].r....UB.i........._D.?...C.s.w..[.n.6....y...vFy%."i...Z.H.@.^j.. .H......y.;.:yD.#.l..Ac........{.0F...F')-.>......".4.b;9.{...N...m....j.6...b'.p......r.....`.........$yv....]c..lb...i ..6k.@vx.aO/.A.-#..5...u..b.7../..x...j...z.Q.]C]n..5..q.....g.u.y..^n..k.....E.....0L".I.....%1uG...f.....|...A...;....@7/..v..{..L..{.N$k<4..[.D..$..\[c.=...?3h.....U......y..9..'........`..W.w~.S.l.. .$.t...i..{t.I.w=..ze.svG..,.......HEz...........ri`Nwh".`9l.7g.MD*W;XK +o...q..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\MANIFEST-000001.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):283
                                                                                                                                                              Entropy (8bit):7.209649320402198
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:nKTCHvwAB9blV2qLC/cgsScMMUnK9Y240pD:KWYMx63O
                                                                                                                                                              MD5:2AD96B56490DA9697540D778A1BF5CE5
                                                                                                                                                              SHA1:169654508E190CCE50E6D7009F3683EAA05494A2
                                                                                                                                                              SHA-256:F55EAA3064F7399FBB130B2BEB890AC52DD473CC5BFB7FF35DFEB4C04792B4C7
                                                                                                                                                              SHA-512:03425707ED5D768A4B23DED4E69C5BDE0EF4E0699588C697983299FF027A39EB84A12760ED21C3594679E3CFE535C6C8F9A549D5BECE0A0992718E30C2258DCA
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:...m...A........f.^.....{...%.j...>1...9.....$.....`...{V,..cn...r.$.t..i..xt.B.yTl).n.p.XS[..?&......./%.....Y.......i.?....$U}...',e{.2Gl..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Cookies.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):20712
                                                                                                                                                              Entropy (8bit):7.990275235039143
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:384:thWsfVCSt5mE1ppqub1TjAp6wRnpSfBZHmkI5I7PywkMgkURp6Nvh5jywbhAFJ+:tsMVhm4b10DRnpkBZHyHyiRINrVAFc
                                                                                                                                                              MD5:F1B4BBFD2D28AD0CA146F91311218CA6
                                                                                                                                                              SHA1:F6E657EBE3A3F0263955AEC7B162EA0C9EDC2522
                                                                                                                                                              SHA-256:E542A17984560A2616E265FB3CFA783085BDC60B5AA3E2161E563664EE922C07
                                                                                                                                                              SHA-512:B7CD6D465E5C039D98D66DBCF7FEE0671E79EFE082E0C86C7AF946026AE132E861D0B41A63DA81283EB52170E925DA41A91DACC9319BB1720A8A6704BA5B3154
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.9..../.=l..J........1....j.X.....Q!.6..H.R.q.....w'.q..<b.,F....-.V(....(..#.....~.....*.D......#...v.Kn.C..&yGR..N..X.z........c7.e.U0.>._....f......n8..h.2. ..3.T|.*g.N'a|p. ..=LA.z.;.q.4.+.Q*..e!..R<.?.%D......\2..&`}l.O.n:......z....5T..&.!Y.-...*b.E...2ip...O...\.`....J.)^..u.)..K.r...h......DA....a!..Cr./b..b| ..U~C.A.SK....\t...A..).%.(>......l....x.q...y..u%............-.../=cz.9..a..$h...X..\.D..&. . ...RB8J+=1..b..Q....t..V..mR......)......-.h...{..\.dg.RS...(.~...t..o..?..q(...{het.m=B.....b.Q.G"......f. .no...sn...F.0..%g.....6..T..l...Q.T...T07.Q....w...7...v..Y[i-...}..42.....\)n4..'.?...Q.>.)....B..k9.F.B..e...6.9z...9.o8.|.m.....^.......5T......%.h..;...KU....Y?..Z.....8W...Lc $H}zz...;..s.\....'.....t...$.X....'Pw.H.c...0q.F.......dA..B.[[.E.|.............Y.$/+..g0......R...OR.*/;4...(..OlB.vW..W..o..r......T..do.....d.6.w..+.w......P..}.k.U.4/n.l.*7e...f.S...Q..'..4.ui(.....lF.?.;..._.Q..;-....H.@I. L.....<.....E.....

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):730
                                                                                                                                                              Entropy (8bit):7.688276051983384
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:wdSqej7KajzWk3p3Xv0qcQPb9duX77ipKxvs1Lox3O:mGaAzWE3sqcQeXSI2ox+
                                                                                                                                                              MD5:8CB50EA55A488ABC037CAA56970BE5D7
                                                                                                                                                              SHA1:E55FD94918BA3C0D4A34BFF99F9CCD776AA178BB
                                                                                                                                                              SHA-256:0DE88A8605CAA3D7A47FE3ECA9EE40A09310990775CDA1DF4C340234BD32EA86
                                                                                                                                                              SHA-512:D570023F1CB70154AF74F4074ED40D46AC343471EBAEC5E162A35CF259DA63C5AD1579096472D4DA2E828BEAFC0E0C2CD8017246E3587A0E84F447B06672FEF2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..H&......ii..T!,.%..2.B...i....0.~..>c..D`..we...s.T......3h.$0k.i..D...;...-.sV3..)I=...NUb......V..Ns....F\......\am^.'.z<...3"l...ov.3..^..e...K....O..c....sC7.....K.V"E.U.%..r....|.B&..Cp*.s.|-..TL..f|&./(..M.<D6..g.V...+Wl..Vg.^1.*.....K.D%...5.3oe5/.......1&o..+j.!i-..!.cp.{..|Jw5(IDH.^p......U....7..*Lw.S.....U.{.@F..t.{.tW.....ZC....YY.L......K...Wv%6i.<..,.m^..c.Ivy....P|..{..DI...t......E8...G.|.......k...}..RG..QuvW8&.....|..3....p>.9..0.........`..9..t>..m.1.......}.i.xt.I.w=....5-Q....;.K$.9.U!w....":.d.If. ..^@.....s..;.N.Pq'.J..T..5+7...8..&y..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Reporting and NEL.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37113
                                                                                                                                                              Entropy (8bit):7.995115303004345
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:aNdgAFmYyaBG9hOe+KNY9DPuvwhur476IIMREPcWNBCh:VTYyyG96sYnPHI/Plo
                                                                                                                                                              MD5:FF3F3EE9DD91AC72AC54CDD1F79AE612
                                                                                                                                                              SHA1:0724051065296DABBF6E9DC19B91DEC6EA783D76
                                                                                                                                                              SHA-256:4F0B0A5AA75BC8205B19A7D885EDEF23697B2C8C20D80631110B37E8837DCA02
                                                                                                                                                              SHA-512:76DCE591E5E760E51BC63E8DC658D8A3E7B5E2B8BA84BCBF4CE42C97B5F23BA15324D92F58865048948D6AAD83D165E3A3944E21422433433AFE4C7ABDFFCC7C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.H.'.dU....\.......E.9{..-f"=......j......?h;.?....(.7v.,.u..4.S...C~.V..s.@E...0.a.4..".{.a..mv.Y.e.\..b.Z.dC.<k.-.. XZD....T..@...Q....a.in..f...S...rK.5.E:KrK..$.UK8\{./.."...1.Y..M.Zr.....Z.Y_....f.}b....IaO.;RYZ..h.-.?..k...,..._.Y.8....T.p..`,..:..?...H.0o............;H.>!7.:.../.kD.b).....w...Y..s.Jw....H.YQTVGqz..=1.p.T.L...r+..v.u8r...r./..J_..,.X....%.....@CCU...=......"....~..........[g,..C\..bZ[....g.!._Cv...`...|.n...V../z.l....x.zX.L-.X._.....(..P...&J......e.p..# ..0.dk...IY......'..^.<..e.n...j....#U....._......yu.f.;.s..B...K.T.sq...V.g....'.....:.^....n.N.<:.+..r......@?(.....o9_..h.p_.^|!R.) .....!......S...CY.a..1W^!5....S..........h.f.G...|........m.^.X....x..r.h.v...E.*.......t........hx.y.BA.......U..^..|f..c2..g..Y..S.y....5<.YP...0.Vl.$X.#k'.....)Z......_.E.....!x..R.#.^.OcC..D1.........l$..VN....%.:.....i......AQ...!..?<....Q..}..hf`.B0F.bJ.W..1..9...Xz.aa..%0i.t....<..{...q.l...A.|........S.n169.q.+.b..>..8o.

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4067
                                                                                                                                                              Entropy (8bit):7.951008848818869
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:WCGZfw8vDtAQAEY4ZIeD6x8hfLpn+9TzGRsA+:Whw8rtW4ZI3iJ0u+
                                                                                                                                                              MD5:270E798FB759E868CB863A48476B7CA7
                                                                                                                                                              SHA1:91E1479A4C947D0970F23E344C035EC98D5FAD4F
                                                                                                                                                              SHA-256:A1A729DCAD601CCD6171B372EF04C32E28472793B267E47C048359653E375787
                                                                                                                                                              SHA-512:897B583EE5D21C966A6EE21C4EDAE3E7C30EDA721F5D309ACE5571EA99420C1077295CA473A5FA6B128D72BDB3051FD4C1C253DC8A6FF04B0DD4D415A1D320C1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..<......<.B..7<.8.fa......\}.Fb.......hS.......\...7.-'i...l.A..z... .......r.V:.U.....b~...5ZN...2t.R...G...'.._.....`.Z.Yuk.....*...6MY..t......T.....u.=}.SR...c.3l..vr.v...3F+g...q'....tA.I..W.`.....p.b.d...}#.0u.1^S...s B.......q...E.R..Z8......_q...C*.(Y.n5...w...v.....tk.L..S.g....9...w..dbq....bO.o..7..)..p'.!$......0.....^ ..X...d.v..g/F$.Up...M... ..d:.W.......,...T{8..!h.<.../..........rs0@....^L4F..,..).K..$N9_<...B...j7.)...n.P..e..k....fS......x.{.....s7....W8.......y...x.v....ab...n.=......G .y.3._!.9.V.R......h...w.x}.7....DI...s..t0.U......}.?6e...P........G.F..8..;..gb....U.QQ...D..P.H.I.......^yDMIL......4s...p.05.C..r..}x....F!.a%.Ag:.2,..B,....@}T....\.n.X.......^.m..p.jp.`{.._w4...O.u@s!%.gI.{..S..&k..//.|....u1i..D.w..N?..V.7.k"....`wnh.8.........#.R<.u...&|z."..8..n1.S..q..N....w..d.b..P..F../p.......M...@aL...V.JT.....F.....]..s.f.....#.H.I.....P.F:Y..GGn....o..,^!..'.......u.[.....z.....(.8.$...S.b.x...A<.y

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\CURRENT.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):248
                                                                                                                                                              Entropy (8bit):7.234162338490554
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:2swNjghtE4HwODheR/WE3KY/cgsScMMUnK9Y240pD:2rjCE4H5AoE3v3O
                                                                                                                                                              MD5:D33DC94A7F21A3353EABB33F49DEDF5E
                                                                                                                                                              SHA1:27AF639B2BF196F153C64E97BE967F88EDF0E1FC
                                                                                                                                                              SHA-256:C01EA2904E7F1825BDB7C7C3873003DBC5FDC63EFEDA55670AF29A1810DF15ED
                                                                                                                                                              SHA-512:6724DE3D6D36C1AEDF48F2305DF64F83EEFA907321FF2FCD05127CA400B013A65E3E2DA66DB7BE95AFE20C20BD8C190ED3CF12349CB4C62E39B140864676580A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.}..6>.|.......9......l<._....K.-+&...cw...#.$.3<.5_..J..C...>......W@B.........5.h..zD......P.;...U..0.'.c..b..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):549
                                                                                                                                                              Entropy (8bit):7.628057327679764
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:Jw9arHoR1ISmPXajtIXHsYrH4MO75Znic3O:Js/Cq+sy/O7fic+
                                                                                                                                                              MD5:DCD1D909969D833C0A74046FF0AE3D9C
                                                                                                                                                              SHA1:A674E3B980B49C6D0D706C7DF8329FE173734BD2
                                                                                                                                                              SHA-256:BACAF0D73FAD33374497C9705A6BEFB1177041BE9653D40FC3A24B086B89ADDB
                                                                                                                                                              SHA-512:C9BC5C62C5E9B168BD7528AB24FD5A037D17A1317F0A7E68D99C1BB2E01592DA9131E157780173C2408432179DE4CA09A8D6A03AB0ED3FBCCDE537A3053ED8FC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..cA.....v...8.6.>i.p../.d.m..y.`.....i..."x.}.%..>..|X.E.A y..j4>.h..Z-.Uy.S.p~i......2.2....4.......F..../i..v..T..0...E.Cj....-....m@.\......!>q.q...u...N.v:.l......\...d..`.S...P.....SoD&...I"...Kr?...X...{q.G...K5.....7..>..`.\s...^.6.E..z..o8{+...?t.j.;....!..I.*....?.raY<.j~..B....%...c.......o... G....9....0Kb{.....K..y&...ct......A.2V......D..0g....r|J..F...bJj..d..|..A...'.FU.g...Z?..).[..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):557
                                                                                                                                                              Entropy (8bit):7.645690291296517
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:CjzDW0/oiJVHflfGAn+CuEL3X5vAsO5SrG51QqDaowVPUIhqXB5xRAxkCLLYRiI7:2zD15JMEL3xAHgKrxDaow5KHxQk7Y3O
                                                                                                                                                              MD5:EA3D4BEFE81840A34F9E10C6DEAC9A6B
                                                                                                                                                              SHA1:5261C64BD3C8F6D4B873F439F671C20B06EB0EA8
                                                                                                                                                              SHA-256:4316F2B05061A7EB44ED480A3B0017B8E7E113077F675C537F63BF241C09BE16
                                                                                                                                                              SHA-512:03E77DBD52192C462981881B80C3B472276AB421F98C95E0EE69977591A2D654A2CF499867B4497DDF0CABD2516BFBB90D3E2AA01D61206960619F7220EC6C36
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:...TC.....o.......`.^.R+..c..)Y.d..0..Su.'..q.GM...~0).@h...C.Ou..K./.SC......f+..............8Qk..Zm.kmGg.....~J..R.<.H.DMa._...;T...d.,.9.'...j./.?...O|u.......!j.%.ti..0UiCj......TN...6.x.hy....0.......P.s+...c:%;f......M...........oe.)9..!_.tw.(....#D'm.q......^z<........-.].t....._2.R.S...P,.....IJ.......9..........|..Z.-yt...ct... .$.t"M.S{{...a..Dvu.t..*..'.x.3.Gj3f7mx.lG..1. ...&P.......2....2'c..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\MANIFEST-000001.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):283
                                                                                                                                                              Entropy (8bit):7.190500868497277
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:pXaT315IxF3HwUo9E4L/cgsScMMUnK9Y240pD:ET3IxF3wU6E4t3O
                                                                                                                                                              MD5:0E9403B34FFA78A74C9906B6100EABDF
                                                                                                                                                              SHA1:4BB4284702F23815CBDBAA07EFFE207380224DE0
                                                                                                                                                              SHA-256:5A84B87BA811294D42C241BC8B5CEB3A1A87887609EB82C9D053916879BECCAB
                                                                                                                                                              SHA-512:5B14D7D90C3B7C5EB3E12344B929120EF2BEF7C9196E7BA2CA92F2A7A19FBFD8E3234471369733EF605850CE1621F369627C8B66B9CFEDABCB5261E290CCD509
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:-..bf.........Rrr".....%.L...6O.pM.._/).k.9.....$.....`...{V,..cn...r.$.t..i..xt....1Y\:..".N.1...'.3...E....?..C....z..c.^..%.M.tP...r.tT.Cl..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\VideoDecodeStats\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:OpenPGP Public Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):131313
                                                                                                                                                              Entropy (8bit):7.998496231530033
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:xZGfiMouMjrDDYn1L0M823A0PkA/VACMsLdVmLrioovlh:xZyiZrDDi1p8GA2kyVACM6dVmLmdj
                                                                                                                                                              MD5:06B6409CAB91A68DC438F1CEE45E2E5C
                                                                                                                                                              SHA1:04DF5A55A471F86AC14942E56D9E75CCB680F756
                                                                                                                                                              SHA-256:49250DDEB53E772798E9327361DB8561393BEF84FFCE8ACB42F2F7FA8758CF6D
                                                                                                                                                              SHA-512:ACF2307AAF75B9CC13109C81884C7D5FFE76BD6363A81032E2B596C11D1725F87C1BDD8ED4C88C771E7021052385B66837B9B84AA78BBC77BE659D2051A389BF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....Ie.....<=W..8..P...#.....A...4.g.D..q.OMJ.$J..|....OZ.&.}.Z.3..w.t...=.D,...,D^.*.X...j..Z.@..D.....z.8.~}G.\...G.>.<G.-.......ap....X..9..m....E.q.>%|..Y....@..pp.Y.m...H9..n.}X._....b..nU.....].M4;..{._.1{.........N..Y.........A.Y.D......%....]....N...&}*...."O..~N%. .<.?....a.5a..I....!.......V(.......mM...0..:G<.).RMx..pa$....p.Y.L.....x...\..7.mX..3.,X.+"Nv......:..}:.B..N...^B=...yN<..........*.T..1%......2..b......[..S.,.C.K.r...0;*.|rk:.C....../.....3.gL#.e+.T^....o.>........4...l...&...L.."V.a.C5._...r........X.{.......v........}...c..vd.E...@.b......<C..=d.)N.e5...n.}.(o.U'5...v.}.....k-.3f..oz...YX.;c ..*R.3I.......5..7..M.....?%.zs.V.. ...%Z.H..5...#.......=wIj.1..o.L.dHI.0.MR..v..6..}...\.*....i..u....i.:....z~..&t[.c..q..P....T.Q.V...aB....X..E..Y....n...(..I.QzE1...U.!%G........5I.'...$.g#O.K.:.V%K@..\..Pi.(..*z7N....A.}.w..\..2.w}...}~../.W.@t........."/:..Mr.7.i.H.8..Y.vn?.;..N..xn..Q=E.].@U...N:>.........u.

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):339
                                                                                                                                                              Entropy (8bit):7.322883480769296
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:7788T4KYTbYBs/B4Ey9gGDdl4JKxPqW/K6ImcgsScMMUnK9Y240pD:fVsKCYBUB4Ey9LdlppqW/PIY3O
                                                                                                                                                              MD5:44B6F3518140AE56830D2DDC2B0F0F1C
                                                                                                                                                              SHA1:6944C206FF7D9FF6DDCFCA42765F36B7F225AAA0
                                                                                                                                                              SHA-256:8A55B025FB7DCF8F4A9B1D3AEC1F591A3A73B7EEDE01869896E91C60420942C1
                                                                                                                                                              SHA-512:B9FC8C5F7DD24534E3CAE5A6C448A0F0BB976E112158F827B7C847A5BD352AFC4F66DF6CDC0AE48C2C7EE39EDEDAEC6B0F22F4E232496208EA64BEDBDFAB90DB
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..|..IH.cG...wfoE..2.!.+.....6...[.Ho9......>.}.T.g...O.{.t..NI.N..W..W...u...e.PP....w:b.i.C...?t6...T.z8..w.......|..Z.-yt...ct... .$.t..0.....z.x......<.r.W......h..MQ.5........Mi..8.s..9.x.v.Zc..c..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\CURRENT.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):248
                                                                                                                                                              Entropy (8bit):7.163558407021497
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:iQshtE4T4KmjrCYVbk2mcgsScMMUnK9Y240pD:buE4cLjrCYtg3O
                                                                                                                                                              MD5:F19FF362161BC10FB0EF7D45F3C43317
                                                                                                                                                              SHA1:F636E94FBD9BD68498001C083ABE7E747BD8E07D
                                                                                                                                                              SHA-256:68220AD136EC6FA145A91E1959AD86C369D92F58CDEF280B93C178CAF61246A3
                                                                                                                                                              SHA-512:F03CADFC1DB149435A692FF607C3F92356AC9C16C885AC07A81B604CF6B6E3CCFC4B94A9BC9D3DC169CCAB80102C7C83531A2477F43D1CDECAF8BBC98CBE1485
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:J&#nI=........c.9......l<._....K.-+&...cw...#.$.$_.sNe.M.j.*...M..:|...pl"..Y H..A^.......%]...~<.c.i.`O.S...b..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\LOG.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):546
                                                                                                                                                              Entropy (8bit):7.60270897566694
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:QxQykgkU31frFOADaergDe4kGkb1b5ZR4DVLS+hc3O:Pgkg1xOeA90bpOLVc+
                                                                                                                                                              MD5:D78145BAEA76661C83A94D3121D96362
                                                                                                                                                              SHA1:9D7E86CB58386683D2456C5A946233AC08F4447C
                                                                                                                                                              SHA-256:11A4A7910DA7D856688A7FB6D9238BBCFABE77B5743E66AD6ACDB728E47B2B10
                                                                                                                                                              SHA-512:8AE762AAAB03235470F5B370153D921370AF6904905B690259E88D2BB28D265899FE0F343D20AB962AE6DFD03BEDCFEBA0773AA5987866E1D97E211C4CD0B111
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:n.2...n..6z.{......Qi.~...<.G ..}X=..f......0?_.......9.'.....9..L......*B..(.MA>...a-.J....y\.....(}.9.hx..;|...h2*....~.|...$tt.XR...+0"....R.o....p..l.G.,%.5\......Y......}sy<\.R.d.....ZV.........Mq....b34-.v...A8..C .C...^.I...`/..VR....g.&....`3.E........n$>..F.V-i.......qh..t..!...gY.x,..W.#..9....0Kb{.....K..y&...ct....<..p&.s..Q..~...r.'........(.5.o..Wv).j...`gl8..vw....[..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\LOG.old.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):516
                                                                                                                                                              Entropy (8bit):7.615592979572454
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:fzKYm0Ta8IzGK4uQVafoXx7epSHph6szLfTuPKs7OeI85fXagaurF+oIde9zcgs9:bKYm0eZG7B9ph6gjTBBojaa9t3O
                                                                                                                                                              MD5:2B4D6532EBF33114C5B5F11EFF7264FD
                                                                                                                                                              SHA1:3C037870370C62C3E9EC1097FE7C67C2C9E2693A
                                                                                                                                                              SHA-256:BA9C36A4BC62DEA75875CE941CDB75A37C06068104353AE3A1CB2164C2F98E8B
                                                                                                                                                              SHA-512:95DEFFB7136C1793553A46E78DACA23C33D78D8972C6582E1CBB538AAB6510F521053741A58CC681DFFEFAE3AED37FE4238680C1DCEA05B44D5FC614577715AA
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:g.i.?.$a"d.Z..J.,.M.W......%L%..eq*.$...:.|Q..tU..q#~O..`.&.c..b...e....<.......W...Z....S%8..fQU..1.....c8...2....r...\p@3..Ix..O......c.z...p.O...5K.>.!...M.v......P....N.$..^..!.6.?...*."...r..L...bR$..~..3..;....F.sv..".[....t...j.s].&....R.A...=|P.....,...;....*.FyY....9..........|..Z.-yt...ct... .$.t..W..2.} 0.....2YW..65.$...<-...SF.N..w.c).V..:...yg...@...,...c..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\MANIFEST-000001.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):283
                                                                                                                                                              Entropy (8bit):7.213205085562302
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:k/etphF2AeILNjgAcgsScMMUnK9Y240pD:kmDgAe0Nn3O
                                                                                                                                                              MD5:FF1B979D49C381C324A9382EE1546735
                                                                                                                                                              SHA1:26D6ABA7162FF6D1C0E8C55CB3954764D91956A0
                                                                                                                                                              SHA-256:20410F3517966F36652DB3B7DC7DEC1E0837DD9C6B0C2214FACEA6573465FD0A
                                                                                                                                                              SHA-512:08AD4C2862AE66053461305A6A7E2314AF9A19871DC37B8F5D16338E4584F48C86C1E83CE156B6D8B68147A90BE0B74221E65CE897B6D9AB0C6CEBC938AA1C1F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....\S.....P.......*..oH.....QwCp`;|.&u.9.....$.....`...{V,..cn...r.$.t..i..xt.......w.r.... .4....Q..{......p.~Y....|.MNN......K.2U. ....l..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:OpenPGP Public Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):393
                                                                                                                                                              Entropy (8bit):7.4871006117574135
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:0Y++PnG2C7MqWCZ12QejKvAi8hSehu+/kFJKzBtInsQfgdKcgsScMMUnK9Y240pD:HjGGU1m2p8dvpzBmsQf53O
                                                                                                                                                              MD5:436B5977D1C7870A0A55B9EB2B60F306
                                                                                                                                                              SHA1:E28EE58A5869D3DCB9929C543A32742CE409E972
                                                                                                                                                              SHA-256:1ADC0A3869EC54F454970D115D9295549E55564C3B2F7973600241D82E06DE21
                                                                                                                                                              SHA-512:440A48C782F0181B51AC1E5C5C3B8431EF4730600252066D369005C5E061ADB6F0EBC33304DF1D6BF290D2BEF6E322E139F4B39D3E891F994A1CE5A223CCBA1F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.s-..x7.[..*.)z.D^j+FH..R.c.3...g.m5e._.....lu,.8G.g#.....at.y.3..(.Q1iW-.i...v....1...z..%..{j..Yd...\.ox..[e.,.?...Q....6e.<._..S4.........E...L.:......z8..w.......|..Z.-yt...ct... .$.t.s3.l\LSI...!..q..X..LZ.,.f....e......G...3.......e-.c...xbE:.c..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\CURRENT.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):248
                                                                                                                                                              Entropy (8bit):7.171780584510639
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:CDjyjhtE4LV3nj6GQd4UfcgsScMMUnK9Y240pD:MUE4Z3j6X4Up3O
                                                                                                                                                              MD5:3285AA721ED19DFEF8B176E3CE0D107A
                                                                                                                                                              SHA1:D7A32281F51D6530E3841B561E15DF5E8308C9F5
                                                                                                                                                              SHA-256:86E4405C4E98DCFCEB1BFAFD5BA036909C769BDA0F65433CA14BCDF830B86218
                                                                                                                                                              SHA-512:8648EF1AE96C35C9D9B66FE58E0659712BC047235E2CE288B2674DC577221917D1FD55CDAE9CE7EF20C29B2B2077E8DE0C9F05532661D4E1A2602D7F354DD801
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:D..1...&r..e....9......l<._....K.-+&...cw...#.$.s.bP.p..........h..#<E.R.."5..R!`...#7.c.v.......z.j.pv.....$b..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\LOG.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):564
                                                                                                                                                              Entropy (8bit):7.645535486700124
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:Es6f4gkBKBC54t4RpLvbMJeY+8FdVBFXtfNEDrd85ZF1DW7XRbc3O:T6f4gksO4t4RpjTY+8FXB1t1EDOtZW71
                                                                                                                                                              MD5:53B9D23BCFF13D874BFDBE5E365593A2
                                                                                                                                                              SHA1:FC5ABEEF6D0FC76A315216A839356A584F647C86
                                                                                                                                                              SHA-256:684509EEF4BC405292041D0C38F69A05F12320DBE0D72C94EBE17206E5CE8399
                                                                                                                                                              SHA-512:668A3E2D9808CD922939288EF8789806B85A7A31DD8A42B0C2B5A56C139F888E072F20CAD342629F75D61171C0CD3F6774E92C50159DC353AF4186F50CC402F8
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:" .b....c..#).s....$.....Q.w[.N....q$.Z...\cC!.5....R...l.....-:.!.D[...E....[....SJ...a..v..k...i7.O......^."..Y.......Q..eB..}ui.A.X..1(r..A(......Q..!.F.o}......6~Y..^Sf9A}.{..H`Mi.c.B[+.u.....i^...9."K.%.4..,4p#P.:......h.....yXR)L....7....n.W............p..1TR...'qD....c.q....W.Q....p.F.J... ....?D......w..5.2W.3Zl.c.9....0Kb{.....K..y&...ct..8.~u.....e.:>\.j6../O=H.8..'...C...D%...!.{.w...Mzy*.~'[..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\LOG.old.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):534
                                                                                                                                                              Entropy (8bit):7.6656264459058345
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:QeLrdC83QbupBAlefM6UpU1X9fkTebUbCKPFkT5f1MZel/rMSefHvJmcgsScMMUm:QeNCBbPekvpaX9fA7FkToZel/rC3W3O
                                                                                                                                                              MD5:391F99A48C048EE3E011F5CCFF48D318
                                                                                                                                                              SHA1:8C91DA83B014863F39CBCF01FD4B272F022C2746
                                                                                                                                                              SHA-256:B76CFA57791EC084F47100F9E44AD0E9513FB20F28CA39B3215E5E911C5044E9
                                                                                                                                                              SHA-512:E7C3B86124A731BD6100939AD9FB84E92AA184CD43F37200360CBEED1B7360DF0D92320687BC76D82FE94317FDD12A9310261D4438EA96243FA78327CBC07FB8
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:FO.]B....OxG.E..@.......r.j6+..)....}.IOR8......:M0.0y......./VQ......u.k............. ...zK.._...j....W.e..\....i...]3ja..o3.4_.s..&.Kf.>Y....VH....a....:.....qz.v..V..Q.=.... .%.P.e...AO....?<..V.4...&.."Jl.+bl{.L...g.~...\..LJe.,qK{P.*\..Y....~...}..t$.cN.-:..p...M_.O..=...9.LX.:u...9..........|..Z.-yt...ct... .$.t.Q..S:....6lt...WS..h.>.Z.W aaX..M.9DR.So.of.&..S$P.V&g.'..#'...c..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\MANIFEST-000001.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):283
                                                                                                                                                              Entropy (8bit):7.193429919463037
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:oozeg8aDTQBavJ5xWCV+wMJgQRDZzXsOWcqymokUD+tzwMFSUNnKeGgXlUJJ40Px:opdI0exXPzuJWcgsScMMUnK9Y240pD
                                                                                                                                                              MD5:BE8451DF612184E39D8B001E5D16584F
                                                                                                                                                              SHA1:7AA4A3710081C71C8DA8CFA0F912818C9FFE5489
                                                                                                                                                              SHA-256:FC603D94F852C2C9B2655AF9FAE425A35462DEC8078351AFF94FC7AAE048DEB2
                                                                                                                                                              SHA-512:747149D2872A5E21B3B9CEABFE788A322D449DF9F9CF8440A06A8CA3ABA1B72FEED825E2CDE22A5EEF6693768417D2885C20AF0C0FA1130713CA216249CB5C75
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..YB.0Dq.J).z$..:..I.-.6_4.\..K..3......9.....$.....`...{V,..cn...r.$.t..i..xt.A,....E...l..Lk......d...D.....-%.w......$OKH...t......:.z.}(l..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cookie\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\Linguistics\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\LocalLow\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\ARM\Acrobat_23.006.20320\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\ARM\S\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\ARM\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5}\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\CURRENT.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):248
                                                                                                                                                              Entropy (8bit):7.170153052277138
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:E45phtE4dzMnhpKsb/cgsScMMUnK9Y240pD:R5VE4dsJ3O
                                                                                                                                                              MD5:D494368EF288DD861D82237FC3542891
                                                                                                                                                              SHA1:657C1366DB4736A21C0E69D80C61A8B1ADACAA44
                                                                                                                                                              SHA-256:BD1742EE41119EF5F413A2CC7A01848188A605E72F560117F98A56D8EC76B30A
                                                                                                                                                              SHA-512:931492CA0572147D8719B1EF12CAE1056C02A61817C84F9357FAE72AC00446F0A925C28199F1D2472B23F853B26A0CA828FC6CE363148C701FBBF02CFD479000
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:P$PF.M.V........9......l<._....K.-+&...cw...#.$.$...9.w...V&2nVi.......v..h..j....8G.0.:9.....q.(....C..;G!.i.b..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):253
                                                                                                                                                              Entropy (8bit):7.209027023199726
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:M4yQ+L2AYDc+QFFKXKSzcgsScMMUnK9Y240pD:M4yXL2jDmFKay3O
                                                                                                                                                              MD5:4FA280F1A18C4FC6A6BC1EC85A4E6D21
                                                                                                                                                              SHA1:73A9598F7AE1E9E7508EFB25CD3B4CE8D7BE87EF
                                                                                                                                                              SHA-256:24B2A97A509FBF4532087BDE309536540B8B52053C814AF2E3C899F4A729A3B4
                                                                                                                                                              SHA-512:CD4B41BFA124FDBD0B65BDD00C3158FCFF8F7A14FE029D30C5238D4CD7F4549E50B4846BB15CA0976B24D6DDFE474A011C78E6379F679F74EA35915C5D0A5578
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..}.Ry.gT....'.3x......8#9.. ....).......-y&...ct... ....)Q."...C....h............m.V.A..$.F.jHs..@..Q.#J.U .9..1._..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LOG.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):508
                                                                                                                                                              Entropy (8bit):7.57793547629781
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:C/XHLyW5MwJ3c7k+cUyEa5ZwCuGF/Mc3O:C/203wkrEaYFGyc+
                                                                                                                                                              MD5:93E7B890135F88D52EFF0EF5916F28EE
                                                                                                                                                              SHA1:76D54284B064F1846A51C1F522B5A51CCB691A68
                                                                                                                                                              SHA-256:7BBEFB9B99AD670780BFC5306091B14049EA1909DB27C969C4EB0A6F10245C54
                                                                                                                                                              SHA-512:1EC7E628F377BBB02AC5E376EA660A2B1432F620D30EBBEAEFB13A3435415D83D519957E207730D19719572ED34C55A1BDA3428FD0831D16B20A97AE885F6633
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:;....T.........g@.M.j..J....<~=.6Hi..Y...?.w.:.#..)t.....C...9.|.6.D..)\..U....[I..EW.N.tD..5A.......X4.u..#.E+.EA.U/P...y$.>f...6i.Q.).|..BY..................xh..w.26pYB.....?.l...,.\.F.<..j..D.z.c....P..|G.).5.3..e.I...[...J..K...'....d.w:g.HA..`...,...}xw@x....[..9...9....0Kb{.....K..y&...ct.!UDE.DL..e..NY....Cl...K.o.w..<.".ia.tI..\..A.q"E.e.c....4V.[..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):516
                                                                                                                                                              Entropy (8bit):7.6042033537127915
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:QytiDkbEvaA6CL3IUbln92lGRHUglEqnBxDaQw5fiJ9hOTd6ximxF9zcgsScMMUm:0QIvL60vblokXmQVjhiet3O
                                                                                                                                                              MD5:D9553B9A74CC6EC91C532347C64053A4
                                                                                                                                                              SHA1:4B71810D8F85025D4F5242C34F96D61E9BB3A56C
                                                                                                                                                              SHA-256:EA5A43AE177BCB20838220AAA4DC49431C4DD0D124C20F2DEE31079C876454AF
                                                                                                                                                              SHA-512:76BDF23EE2AAA412026288855FA90A8F59577604AE2D8CF31388204382643A1D551491C8DA27348C83018C91D02B9EAD9BF7D1D3D6980F987683B02D792D3FE7
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:w.!.....bf...n6Y..<.vgD...ZN.../;..z.R/*K.......k.H2,..$.\~....J..Pi.8./.wG.u.+...r*8.u0...~....Rp}..,.t..v.........N8..rM.}.....V....u...t....%.O.o&h.....c=.[{C.w..T_ .)..G...x..<..e!..Gg.'b.....}sO.}4.kD..IG.J.3.M.:.........t>e%=$....<..T.O...e.F.$..S.:U....Oa.{...O;...9..........|..Z.-yt...ct... .$.t.....'C>Y."Y.g. ...C.s{..Sk....r.k...m|e..........!.....K<..c..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\CURRENT.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):248
                                                                                                                                                              Entropy (8bit):7.223718425322075
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:qfbshtE47QDKOw+/N9j7ii/cgsScMMUnK9Y240pD:ibuE470NB75J3O
                                                                                                                                                              MD5:6C23627AC9093DB7011A6D319E1DBC65
                                                                                                                                                              SHA1:56BEB361EFD2AC47D78403F353B3C2AEAE3EC9D0
                                                                                                                                                              SHA-256:5C60AA7D03E930EFE354D50A25A9D4CF78D20557EB21B5FE8D0C5DF1D8DEFA9B
                                                                                                                                                              SHA-512:26CD8EBF709AE2544DD9313655488184C903EC235A190DC9D71F0F9037998C05A618A8738B5D76FD0DFE9EED05DB745AA94DA031C5D58D480A0D8E3AEE7D8905
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:ej.{S......w.Q..9......l<._....K.-+&...cw...#.$..t.f3..(..P..h.a...>.3..F&.c......e?P.1.....I..2.V.2.^k7...m...b..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):552
                                                                                                                                                              Entropy (8bit):7.609028092811506
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:g8YS/raOUaKCjiQC9b64j6VWt8L971ZPxkBxglLNE5Eg4aM9oifyhwb1wnyBfOtU:xXjSQIehp0CPEcCSBEta5ZRyAzc3O
                                                                                                                                                              MD5:58C7FE13D21E45116B2063B2795400AF
                                                                                                                                                              SHA1:C025EF129452207BEF6BA3633DCBC5171A0A4FD9
                                                                                                                                                              SHA-256:593C8379675730DD6C3428FB41F76829C324EEE70E08B3232ABBA0F11D5E136D
                                                                                                                                                              SHA-512:2B4A3FC5F2A1D17BBEF84198EE46ED6229879CA001446B41843611333A161F63B5F6726A14EA02CF3A28A5401B48BD943E57E33B47508E815D07EB5B31CDD55C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.P./.......L..m...AW.u...p;...].r.._.iS.i{..[,.....7.X....7N.a....-..@.*000.....0nT[.!H`...ch@....../..c.|...Q.Sf....M...y}.RkI.h..~G.D.$.b...H...n~y".C(...t.;.^..D.......A..A..Kt.......3b.*... ....H.....A.IQ..q!#..R..O.F.....X>...Wi$"/Szq.....`..]....].>...Y...C..p.1........d.`..b..2P.s.......0..F..E...9....0Kb{.....K..y&...cto.W^.K..H...0Z..1..\.;...?.U..5...F.V...'....LR.......'..QrP&;[.[..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):563
                                                                                                                                                              Entropy (8bit):7.570981778765162
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:2wKPd/G11Fmv3rJL4MhNG3UblX8UDHUTXKQQ9it3O:2wKPNG11Ev7JFGkblsUrUT6R9it+
                                                                                                                                                              MD5:05A479CF802305FE3CBC3495CAB75C4B
                                                                                                                                                              SHA1:CFA54C667C6945F6107A2E42E028E2E63C90209B
                                                                                                                                                              SHA-256:D7F2179DA4292A6747A3AA129794B0B52D67F7B97B3808CAFF4D8CD34FC82F03
                                                                                                                                                              SHA-512:599B72BCCEBBE9FC1CEB4CE31E3079E1B1C2D57ADA232817E36863F2770944B2333628EB9A461A11D5E27AB966F8195F4E00374D10CB1F61462F71A7F86F40E2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:C..Y..q"..*l...n.hFA......z..{.Y.A......d.JH.............XA.....gL. ...2..8.o.....8.L...y.J".X.:6.P.....o\{f.....r...]Q...M....[F..d..Msy. ..]...t,.?m.df`j..q...U..Q..N...b.0....P.D...B..h..N......S$... ......(.^...k4..kf.|.c.%..@..B.5...e3.$n..e.*..>..L.<@9x.oX.?....y.&..#.bG...:0.?..B..C.d.~...P.BPu|."n.2..>.9..........|..Z.-yt...ct... .$.tMp......a...\.O...:......#.b...?N....5q.?}8m....1...?.p...3...8c..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\MANIFEST-000001.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):283
                                                                                                                                                              Entropy (8bit):7.214722610448774
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:o6cOLrRgkZDOwfVBpSv5avJ5HmpHI22vp9rcHLlkm7Nkw4zcqymokUD+tzwMFSUQ:XcOXI0pGQ7Y72bcgsScMMUnK9Y240pD
                                                                                                                                                              MD5:32A9E635C1907C20F8D718263FC6B46F
                                                                                                                                                              SHA1:FC4737D6EBDE7BC53F7F54C763F98F57C52AA859
                                                                                                                                                              SHA-256:C79610A16C423C0392FB25F53895DB5F772D029CF5C19B549AFA1A0F4E25BB68
                                                                                                                                                              SHA-512:28D5097E922F6B32DF3F938343140EB3471F810EFA4934B3713DD9D16B6A5A99B9ABC1F14C009257EA4844C6CF998537AFB3971EFD5386BD1DC29593B39EE36D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.......F.|O.|....'.t3Z..A.f..g.p..jQ....9.....$.....`...{V,..cn...r.$.t..i..xt.....W_....L..'...TUJ....fp.......+S.`...V|..n.l.W...U.Ay.^..Ul..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):731
                                                                                                                                                              Entropy (8bit):7.730222814831319
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:xP3Ci2QGi1oexZgf6ApuN1vhRre6ss6yC7ShRrJ/HhfT0GOUic3O:xP0QGiNxZfrhRKXs6BShRr9BwGOs+
                                                                                                                                                              MD5:59A270821A3332610EDA355594801D43
                                                                                                                                                              SHA1:71EF81D62009D680FDBB75AE6E96FA40DF136658
                                                                                                                                                              SHA-256:054B7A0952949849F5BB96E8BFED990167BCA75A1D6B7A136CE6058F1BFB8A54
                                                                                                                                                              SHA-512:EDDAF057AD2E3C0CD1FEB50BB9A8570FCA5AAF0E41E1AA79A7A702B2C17A666461DC9D13A88CDE83C261F7B5EE0921E4259F14D823E41C751E58813364967D0B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:H.sxe....2....r.J....z..8..|#9.....WFg.5,K..q..l...pA...\..6Z.....H....:n..V....B..).EGUv.....t..T.+}]._'.........eO.n.E..m.V.}u...P..sQ.... l.N.g.N..}.[.P...j.Vi......*~z....w...M...'w....=....+.d......5..QB...z..l..r.m.......W.F.t8.).b.....=p.n..[>>.d...`..?....p...C!.^.a......f.9.uZ.8B!`t].........Er......\.w=...@.tUe*..o.2d..2M.N....h2.i.Z.2!C....H.....XHw.).".AL4R.7...[,.Mm....&.e..H.A;k@6.`..=.&=....*.P....&O/:...^...^..lu1..nD......".....3......9..'........`..W.w~.S.l.. .$.t...i..{t.I.w=....f7...`=|X....d..|......S.lb...$L.!......K...w.3/.....],q..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\MANIFEST-000001.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):283
                                                                                                                                                              Entropy (8bit):7.216363576691567
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:AVt8foxUvWKW7quydcs0+ilA41BKr0FcgsScMMUnK9Y240pD:AH5UvQrsJ4yc3O
                                                                                                                                                              MD5:483C0CD7B5D593C96BAE3E0AF1A03789
                                                                                                                                                              SHA1:3225556991E342E9DCEB86214D661CB867DB4E8D
                                                                                                                                                              SHA-256:B148A51A594858119E9245EB91CD3CD363ACFAF83FB0869436E9C91E2E49D035
                                                                                                                                                              SHA-512:9019CFD8BC3839691B1666D9556BF92E1A7E18AF00C59FE8DCA93D4A93B3BD9033B71AE210B9798A40FD687F5DF9BCC1CB0B9F7542C9675C4EC3F7F64A6647BC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview: ..'...y.u].cJ.]....)W..z...)+....9..).9.....$.....`...{V,..cn...r.$.t..i..xt..k9..=u...K.Z...Z......Kg...Q..9.]..0,...P#.].]....g?.....x.l..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\Cookies.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):20712
                                                                                                                                                              Entropy (8bit):7.991252689984233
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:384:J5+mLrOVKWX8bfZ4MZjOPLLdi71itDHXRhl+E6Z43tonQJ+xtPfwbng+sE9LzmqU:JMmgnsbGMZjOjL+ijF+E6ZQzJ+/orghr
                                                                                                                                                              MD5:B595BC1CEDBD8955F35397CA1C19E648
                                                                                                                                                              SHA1:364425BFE9279996C21D30FEFD8DB69422BBA6C0
                                                                                                                                                              SHA-256:287F6013322BE1FAB575A4ABAAA6856FE6A13AE5C5C5FAE85077EC2845523852
                                                                                                                                                              SHA-512:1D1FFC09913CB6C995FD981879A8FC812C2AD3305AF2C52CF98695E3BE6BDBA2A4D04F7479E92A03924DD577E8E95CD51E5DC2A182BA0DA92BA9D77D4F6DB1ED
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:...qv........nK4H....@....x .t9K.v..Q...."3...M........;..K..3{....!.....F.w.z?Q......+.g.}.....}. .GV.."HX...L...eb.}....q.Z0......d56..:Q.*yb.4.....f.o.h......9.U#....a.....U....z.p"...w>..T.....h..LT...1......... |_........<.@U...S.!Y..v ..J\.Bu.`..IY-....b.......on]...._.x.^...<.&._.e..Y..M...6...].....;H..'......!.1.~...x.g..z.N.........T..O!.Cv..GO..r.....*c....',..V..w.3#..g#...=..ek-.<.i...i6.0Vi.{O...z....`.ix(N...V..w.5d..g.K../...FM%.P./0.q..3=}AHj...6.@%...l.A.mA..t.N.U.....`.ktfd.S../.......S.oL...x.C...P./...,ht..=g...\..M......n......D.....$:M.(Ke......n .Q..lDZ...>.7m..m..z.2.De..&..7@c%..v....*...G.#...*.....9.].[..G...]2.H..\J.@W.....,.s..%{.Y.H.....E.O.[....f...Sx.*.pR>...M..xD..>...{,.......&..n.i..0O+f`.,...=....~....lM...k.o....!.F..M6.'......oz..gc...i+..o_2[..@......(...;y2p."o...[...*.K.96...B..m......h{g...%.Tz\.]..Km.....5.(a...3.#..'s.3muU0..../......(......i...)g..&...Hq.E..W..z...tM...) n/.J..q...<....

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):314
                                                                                                                                                              Entropy (8bit):7.276146307976006
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:WtU4pf2361IHUFOxvfkAws8WH5KNhc5JYmcgsScMMUnK9Y240pD:Gp861I0cxvs28A5KN+33O
                                                                                                                                                              MD5:8B027B0AEC9ACD4DCC32EA71871619AC
                                                                                                                                                              SHA1:4267B97AA11F103347D509660EF4DC1F24DBA5C4
                                                                                                                                                              SHA-256:2D91231217D356631871A6B0929488709FD21BD35333CBBFC95624EE9E923A25
                                                                                                                                                              SHA-512:41ACAE4D7777A7812D16F064313A9AB8FF8196BBE39B43D83DA943233D664E2AA3DB67F83DD7889D50382580ED0EFE653DF9461651A49CAF05342D4D45528CFA
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:K..L1..F<F$...q.8...._.......Pux..O.......wb......O.Q.....9..0.........`..9..t>..m.1.......}.i.xt.I.w=....5-Q....u..:..T..iI..c...D.lC....9<SD$...eouc".F9...8~...j..+.YC."=y..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\Reporting and NEL.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37113
                                                                                                                                                              Entropy (8bit):7.994501253505494
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:BwARQVCZaOYj8rpzIkL3x9AeTF3pNpFylzUZxDkIbIu:iwA8JIkrx9dhpNpmU7kSN
                                                                                                                                                              MD5:018C4C7F575A1C534A602C1C2CF870DC
                                                                                                                                                              SHA1:5B44BF72F5A5E90BEB6BC37FCFF6D0F18EDE99E2
                                                                                                                                                              SHA-256:91BC2CC8F468C7B92769E22E72A4A8C61D4FAB81996C132FBDE1BB31846B8B15
                                                                                                                                                              SHA-512:D2C828A6011072A5E98CF82199E291B69E18D548DADF3E1DB1C4AEF0E4CE830615BBE99913E489EB9E38EF4E1FA779A10083BB483519034112527B8D53C07A18
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.rm.....xN...w.".7...(.).a|.....o.........."...i{EJ4.DT.....E...z...p...TU...+.-..e=4d...%.....ZL3.D,.`.B:a..cg6 ....S.na..-....JE...I.'.q.q..r#..rQ...O..h.....[Y..*... ....way.........\..-.]~3....k~d<6n..k6....\5._...s.d...#l.......L.,Zb.y...0zf.`...S..8..P..6..).U....(0Y..V..gidyt.oy..7...u1..Z2e..a.....m....#.7..T2[O...Q.........o..g.@....#....'.B....i..:..5......T@.a...'......b....c...R.-s.o..I.wf.j.8h.1.9f..=.k...w.......b...d..M...N......5....#.)..k.....>6|..l$.C.......W...S.q.....q....Y.w..Q.qs.....h\M$q...=Q..@9!y}..".c..L.o.9..a......./.$%r.J...,.E.f...$.A.2l.N..X(WZ..'"...B.{.._.....9?......i.BAH...Mz.-$..Hc.C.K.L.l.5:.#.M.C^...8...X^5..A.I.X.v.l.U!....8.|..b...S~.p.T)..U.c.'x.....r.V.....~.t!...FJ)..[....+...*.$..4......l......QP.6........N.jd.).h....iM...0....d..!.6..n.m...6.6.tI)..>N..n...cYD[..HW..J7..|GY..a.K.....i../e[.tP......t...W.7.M...A-........{..L....O.{...U6<.....w..?.-.../.ATo1.<...b.9.''...I.._.z....E.....}.1eX.Ol.R....t..

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):629
                                                                                                                                                              Entropy (8bit):7.646401646948424
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:IW2iKmCeiPbMg+xMB7XuUX+1xBlwFq9qhtkK/be11zPIpy3O:IEKDeiPbMgYu7XuUX+1vlsId+
                                                                                                                                                              MD5:5EFD785D3C06F8EE46AFA5A479CBCBCA
                                                                                                                                                              SHA1:7DBE2DEB6EBED5CC47C66E1BCFDC9AEF393B49A7
                                                                                                                                                              SHA-256:E5A8CE2A1F50B691ED8283C0F0FD622BA20D4CD7304081E9B15EF09672BAC799
                                                                                                                                                              SHA-512:C90FC982E9BEEDEF980C829487FD9F557E4AB8B3B4F1BC370BEC52DFDF41581AB2DA360EAEC30367B0C5C0773F12D778DB0CFBEF2284605AEA14A1DB33DF8A82
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......T^....o.....7.Z..............:.....U.....n;.Y.5...l..#c....NH?.=.n.2l......T5._.......)....T' ..1.'..Y.....9....[W..I.....@.9....7..."..&.PD.......)e..3".t............Q-.Z.$@9..(........r.]..78.~..]^......{.^...96 .....w....v..i"[.......).^X..'l....Ka..`\.'.mq^..$j.q.7M....U.Q.J"M].1.@..-..Y..r&.K~.eJ_|-..N.o..N...(.../.XE....e5....,...R..I...3/...iy.q.....w...V....Rz8..w.......|..Z.-yt...ct... .$.t...>V...q0.}...).h.....R......dh....!.%..g.q../bu....>.....c..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\CURRENT.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:OpenPGP Public Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):248
                                                                                                                                                              Entropy (8bit):7.143982790197811
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:+T1jhtE4ht1z6SUFcgsScMMUnK9Y240pD:+ZE4h/0j3O
                                                                                                                                                              MD5:9BF1CF344701ED592942E984CEE2D23D
                                                                                                                                                              SHA1:B8EDC4199F4F705EDFDD0E425618A738868B85AB
                                                                                                                                                              SHA-256:730A4E0A3FA398A58C6D6205306CBD2F292898A2DA17BA88DE138180CAFEE70B
                                                                                                                                                              SHA-512:CA0F982F79C9D3DCA0BD8CF3C475D8C667D48DD74A2BB9C16BAAF7288D211761368787B81526CE2B92A6A7ED0CB478647E46EA96D47E80E6FA529A616AEF2F85
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..e....c..];%.[..9......l<._....K.-+&...cw...#.$.U8..s}:...mu3D.A.E.-N`6..5 ....o.8.w.n....h.....9..7.:..Pk.9kb..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):540
                                                                                                                                                              Entropy (8bit):7.681906913001272
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:lBLSFzA+M5L0QtssPLDFZQ5Z2ViYJJJ8FMc3O:rLSFz/CAXsPLx+ii4JJ8yc+
                                                                                                                                                              MD5:9916762743956949A5950EEBA959D381
                                                                                                                                                              SHA1:40A1B01DDE8B24D8BEF23E6A687341C294A2944E
                                                                                                                                                              SHA-256:255764E3DD3124F7116BF7847B4AA11AF2EA22F914A187822619A23A0E01F036
                                                                                                                                                              SHA-512:0DB9EA09A0C86D63D95D35549175707ECC359B1F16607ADF20162257FA3C9DA66D59B2A5BE3267690C73C20F2CB187904BCDCF1951A6BE06391E77A146FD2942
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.W:..}....?.mr.z...G/+.0..z..'&........`.@~..D!=.}..G.p..PuX`.C!..?._#.Mv...3..K..~...l.??JLL.......h...x../.B.~..!v..Z..n*.`$...... .A.......k.V..gK.cX..%...7................,..n...*.-q{........%..$E5....e.Vb.O."..U.G.....!...w_oj.o%*m... ..;.....Y....s.<.Fyq.~...`.EP!.(.nkN.:d.4._M^.].t.-....*...9....0Kb{.....K..y&...ct.]...vA.<.V.Z.B4...(N..Fp.z.l#.Q.5..i,S..".L.Pq:fY-R...w-.8.9NE.[..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:Encore - version 7808
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):551
                                                                                                                                                              Entropy (8bit):7.584770057865183
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:yroxnp8g4Tw794RbPsgs+V5oL+xN04Sypht3O:KoVpv0G8foC/QyJ+
                                                                                                                                                              MD5:671EE0E9A087F6BBCA7CFD3AA0677B55
                                                                                                                                                              SHA1:6EDD970B433A2824FA50FD8B69040C6820BB0AFD
                                                                                                                                                              SHA-256:6814C6142695FD223D7CF3B11785F74123CEB1302780A9255ED755721BE9C5BD
                                                                                                                                                              SHA-512:B8A6748B78565DE7D31EA478183F4A0E6EE87F2F7118E1614E272D2727A4161563D31A495374C87E4499875CE6F9833C404F9A998C22369546C872766758EE63
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:T........D3...f.!....Y..3.......&.w.l.M...M#=....."&.8.>\.z}nY.z...t...V...)...._B..:........r2.Y;..8..A....<.f.^*T...^..4.\.>..E...Lr4>O6Z.@m.9....6..sz..X..h....F...`..x...2..g.....J..._.qx]..".).:C..j....A....6......y..q.......Z..Ugh;.G...X\.M.D.a.8#....,.N....i.....!.M.|..*%.....>.N.}...m;_..n...n#..m.9..........|..Z.-yt...ct... .$.t*..T.=._.....Qst......|.......\..+...-....um.........*j....@.U.c..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\MANIFEST-000001.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):283
                                                                                                                                                              Entropy (8bit):7.225515839821538
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:9n1NDBKeGKABc39iyM/cgsScMMUnK9Y240pD:9nDVu2crJ3O
                                                                                                                                                              MD5:01495106B4EFE4A71C793F3FB0EDF65A
                                                                                                                                                              SHA1:43A228286676916A855BA6325DFC01510024B25B
                                                                                                                                                              SHA-256:7F38D981E55CCFF0D85FE07478EEAED294EC3FD57F1C68CABDA27CE02AE0A6B0
                                                                                                                                                              SHA-512:C0B570BF336557977D337B9E08B2EE714B7C7542E669D15DEB89DC5B377D98919370A52AF64180015E7802E4F8CBA061AE42B8B63F64EF47978EE79B1D81FC5C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:...\.8.>DU..q:....[...&....u..W.N_k.]Y...9.....$.....`...{V,..cn...r.$.t..i..xt..-.....s{.nI..-i.......T.1.....!.5......$O..,.tZ.....Qg.KX..;.l..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:zlib compressed data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):131313
                                                                                                                                                              Entropy (8bit):7.998604569107648
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:7O/SB6fUkwLRB/l8YPbyn0hTpFdXJEmdgLuQ4DaJBoLOBto:0SB6fjwLRjjE0hHdXOCgLuLDaJDto
                                                                                                                                                              MD5:A1A03B5ED5EAE7CACF9C32B35300BF23
                                                                                                                                                              SHA1:6854E16A71C0AF2A0A712BD407C057281C7F7B60
                                                                                                                                                              SHA-256:BAB25FD8CCAB308317FC784819124CBFB4414137077E7DCB5E9C4FDC99FBB2C1
                                                                                                                                                              SHA-512:F3F594646A7752E18AF79F912626F394645E7B4A9B4D8F586BF8AF6626D7E6C73271367B9E527C0833BD306886A491E85E785C792BED149B178B3497A48F923C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.8..........Y....'....5..h."T.[. [$..............Rw..;k....U.6..8.....z...~.B.7..X..}......1C|...kNY...[<..../.k..:Q.<...;CrCo.y...V....._...=3.Z.*....7.h.S..O.`...).X.B.....7O..O7....d.i.6.p..9.Bnw.Lbv.u.j....Dt.?hw...=.?(%7.l.ajn...D..V...|KI1.....,u.......%...U|........DG..w6...M...h...d.4a......U..I.-...#...1....8I..I....[....2.`..#V......~6J...n ..H.H...xGc....k.4...O.N.HE.H.AX{+.Qo.q..fu.t....A(dD.r.g/4/."...5j....a..q...D.j.......^$..1B...K..............R..3'..=H...Y:.q.=.v....SH.8.....N.Bd.W:...X.y%0...e.O=..5.g."..y.(8.......2a...u....6Bpz.Q.y...R.mG. 4^5d!......&rn.t...w....'..<...a..u(v&d%\.&.......v.hEv./..R3|.....&.....\...h.+.N..,h.w.../..-..&k .h..\..x......+n.dh.<..].K.....Hvh>>...i-.....V.b..q..y.....Nos...T,. 9]..7b......E6.i]...z.Pg....o...x....?..#n5>@.X.h.......a.gf.:..G.z.......'5.k..].7."....u.H^..B.....1..a.e.../=F....5.C.u..c...'%I......c..{d5!W......z...P.Q.>zT.@4./..v.......'. VPbC...Zj.r..a~.$...1.}...x..K1b.

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cookie\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\AcroCef\DC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\AcroCef\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\Color\ACECache11.lst.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):842
                                                                                                                                                              Entropy (8bit):7.769643103663317
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:SYPrOnksz7SAmKp5otEx9gxX7XTJ1uF908aUj+:S57j6tELIDzK8Uj+
                                                                                                                                                              MD5:73C32F8F98887C0EBCE339148B0CE323
                                                                                                                                                              SHA1:115071EC0B71E1BAE9DDBE6E92979F7976F8CFD8
                                                                                                                                                              SHA-256:9A668676B64B39EAB955CEC54E2715A12ED55A92176475A6C1F9EA924B097015
                                                                                                                                                              SHA-512:62D4CA7F2D1A295BF80EA2D7E98EC2C12E3205AD989F2716D7E4F43E45C49254B044C5D4BB6603B8DB9199588FE58664EB637D840AA0391851DECF12F8C2FA36
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:,.VY.B[n.y.9.".!..!"v.l.0u.r.n.0....!F...A..>u.<..e._...........3...X..PvO%..B\@.u..J.........N....$.....SJ..D.e..O..8.-.J........qf..-.'c..p...!d..z.w..*.t...T...r.I}..E...8...3..3...........x.-2.....^i....h...T.j&.......W...$........qa26...Y.E..S\.....h...q.Z.m..|^%.<.O.i.QV.vS[...B#.....%..X..n.;ZL....8B.{h........t.&.%?L..,..cZ.<u?4....l..........>t}E.b..4.....1..--....{u...P-.N. .s......)H...?....S2 .3P..KB....e.#zD0QZ.7[.A~.Cx..}7.ZL.iD.s.#..C..V..,p"..+m.@=.....S......t.Wb..%p....V...HV".:....k...&).......w...TA.=l=...!.}x.S?Y.F...tw..|....?..N.0..U..9.....(l..c....e.A.U....v... .v.t..j..xw.I.......1.......ZI.L$/6.......-U...\..h.-`.?......;.m.yx..D.T.n..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\Color\Profiles\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\Color\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Adobe\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\CEF\User Data\Dictionaries\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\CEF\User Data\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\CEF\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Comms\UnistoreDB\USS.jcp.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8424
                                                                                                                                                              Entropy (8bit):7.977643350864883
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:jVuudPWCjnqkO4X9iktqSjr7+ykzS3Jqecx6yy6R0Uf9+:BduC+kO4NdqSjr752S3TUYwb9+
                                                                                                                                                              MD5:D52E608C56ECB178322AA728C6EFDB1F
                                                                                                                                                              SHA1:7499A899183DCC86D6D235195F7EF6CD1833981D
                                                                                                                                                              SHA-256:BBF02832B4CA9DE2269641A670D97D9B157A894CF82C0CBB314D720B1F1FF682
                                                                                                                                                              SHA-512:2D0CD2F333335D7B7C5C422127BDE1B5D0A2A69A0C142523B26380B68BABF8F6F02D7749640160A79D48D958966E56648F4FE9AA291B1BC0FB741F33419653A0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.]r..J..m.?Z.jP....M%.._....j7...SO[=...D.<:.1].[.+...._..8..h........9"..!..p....y}.K.x. .....33..PNj...?..v8..i...o..z....e..+S....*n..[.>..D...g..u.4^3../...r....Ix...... ...V.9.K$7./...I..u.....GY..I.j{P.!.J.=..^u....S...[.L}.....C~[.c....,....oA0.?.r...0g:..zc*..Y.B......ru..S.p.r].`W."..s..2...h#.....+.UX..g.,.s. ..`-.MM................\;.9...*.>.>....5....)0.u...KT6.i.-F._9.U.+..n.A.. .nC...M,....{h....J...RA..N.a...Z"...*./..~....?.i= K....nDYg..0...r...r{....W..E..j.Z.8.5.t.5.....N../Q/...a.W@.K;.k..i.2.^....n.B.G..X...a.*Co.|H.t.&....(/.q4..~..L?..d.Jb*....4c.]@8.n..&..uv.J....!.Y..z}z!..IU0....-..+..(|.J..o..O....O.........*.({Z.F....b.~...cx.....DK$......WQF.og.<R.S..I*..l.W..<....9........&V..].t..3..0..).....$..P....-.z..8[...~Q...S3.@Dd....'.=.!.........../M.R....<.O.)..zP.&..L....5..i....;.G9.../..0Xi*.+...A;.{l.Y.p...N:!..H..s^.....8.V.I...\A.........E.....v..s/.,..i.T..a...$...p..;....k..A..a`....5...t....s....sw.!..

                                                                                                                                                              C:\Users\user\AppData\Local\Comms\UnistoreDB\USS.jtx.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3145960
                                                                                                                                                              Entropy (8bit):2.449742246895067
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:uEmUKX35KF6Vk1vkw0212hSlPlJaxoBxp3VmTIOx2xE5LdCihkCx1TS2:DmUu5KF6+F5vRlJac3YIc/5LEihku9S2
                                                                                                                                                              MD5:4EB5D64DF416A84182448659808D9541
                                                                                                                                                              SHA1:2EC610AC9A154B4950F311F1F61FF40733281182
                                                                                                                                                              SHA-256:3B068F5E154C617477363F747C2383132964916829867014B4047373BC379ED9
                                                                                                                                                              SHA-512:513A00F690BC4ED9C3E065F29804040703ECDFE2CDA71138A4A884DCF267090BD8AADE5C94A1A87A535DA00F9F79AF2D4E38851731428E578BBFF6D312667EEB
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..QIW.e.K].O.~..p....jJJ.j.T'WR.8......R.Z.....Z$.>..<....+J|n.R<...2.=23'..'.NQ..iL`...Q....F$\.K..)S....C[....a..9.......~=.k..x......<..*..k.0...Y.%~.E..f5...^u...X..g...K.n]... m2.Qs...R$...LM.D.A........'.T6l.h......J).h.`"..K...b)LL.......n}..u..\v...M.....!.....|....P...y.F.=..|...bE...,O..........$m..q........O.\|P...#,.%.../A.r....^+.lI5qI.`.1...*.Y.GO..T.6N..<......3I.'1...$..RW:`n..a(cq...c..j)...b.4.T.,...J....A6r....3...Z..'...+..o....(..M4Lu..[.........NJ!W...xl...m..{k._.. .w..ekj...V.Z.".....9....G........x.t.p.LY_...TH.Qc.........}..(...(..e..;........KM..Dv.....ve.........x.f.z.(n..p%.7...L#.0.vz".$....&|yg........Z....[...K.-..Dg..uJO.J.g..F....4.A[S.P.F#.Iq....%......d.!...]....|dy.O}.KjLZ........Z...(.,..oc...o...~.-a.o}..E#.J&P...c(...`628..&.W.~.(._M.;. v..(Smy......p..(S.v... +.L]..B.c....@...^...S..PB.=.l.My.....h....M`D.rq..79..G........|D........<;.P.aa$;...x...>.....=."U.6\*.*.F..E.v.3.s.?...:.#.....c..}y.._I.7

                                                                                                                                                              C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00001.jrs.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3145968
                                                                                                                                                              Entropy (8bit):1.9760547156543025
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:7arekn0e5HbTAXpb08limUN4NooRevmzrAzFoTsBk:7HKDbMl08limm4HeerACs+
                                                                                                                                                              MD5:B3CC1D059BDCF237FC98E0FF3BCD70A1
                                                                                                                                                              SHA1:E03C08D7CE42B2D660788E96C23C7146F546BA62
                                                                                                                                                              SHA-256:BC8F9E1F99772D73FA9D8EE4EE08AD6FC6660438D957060631CAAF500A9332A9
                                                                                                                                                              SHA-512:E86084F46F112EDBC8F8AD8C8B45EFCDCA86225526524277D9E972DE0E6C1C9F0342D23F81C7B389F4162256031168F7A063491BD2B410786017EBD61DABBB11
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:0......=G...k7.0.L...XE.....~...YV..Ud\.=...ue.\.P...B...k.0\..Q.}P..i...n.+6...,.s..w=58.=4.{...*[%.K.g...u.p..Y(D.za....n-... ..YE@..c.V.r.?.Xu.G.T.1...-.7.r.i.~.~....xR...E.#.....k%d~..........$W.neELk..n..|....v...~@.(.#]....=..}....{.=U'.t..u...N.(....{.@.......=0.6./>..P.{.z..'`....}....#....41...".T.<U...C..R.(....QCX..z.d.?m.;.."30d.i,G+a..>...7G.).a..}......n._...........$.!>...."..H_`...."@.W}...m..!...8...VF..P..i..L...eS.E....7y.2..P..%.=..C.MY.O.N..~Q.....N{>.c...R.U..!.N..k......]...j.JD3.3...n..LB;.M....=..5=7..+>..a^j.........>...?....O....i.....y..i..y...(......*..dX.G*..g.....J.9.j.Cy...m...!7...R.B%...St.B@;d....?Y.:.j...8..8+H'q....M.&...772cS.RR.>7.}.......yGu.e....<.n/.H...0TO.:.ox\E..?.I....=.[.FO..?V..^-.4...".."....ER.K.GTI.......R.i...J......P.O....6H..x...H..R......@..J`..4........N|...8....Rf.=~v...u$.f.$.Nn.y......o........^68).....)p.e..XC!.!%..c.....3:..N..HR.>.5.9.g(......W'..^~{[:..CmI/`.V......em.6..E.".

                                                                                                                                                              C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00002.jrs.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3145968
                                                                                                                                                              Entropy (8bit):1.9763068297712099
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:3+RS4qXMl5cHbJ25pH3BvCGJOspcseumZOv6BjJiPG5N2hMFo:3+4/MUbJ25hfOgeXrXiO2z
                                                                                                                                                              MD5:06FB738993AC18D45FFC5E2859ED8CDE
                                                                                                                                                              SHA1:51C7E9425A320EC7FAA147048A02E1B0F96FAA63
                                                                                                                                                              SHA-256:915F95F716DD2E30F7DCB987BAA6BA2D6E0352AE482AFCD9274B8A6E4B5AEF69
                                                                                                                                                              SHA-512:14CF5D57990D749F28C78C13C885C68F674DAED8DC1E3F73BEF9D53E6B85111FEF99333AD4E87D944C9D75C4F11930071EE928C9B42C0C9394BD85109814E1B2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.9..........R..U<..A.L........n.U.......M.....jc.V5r6.|.Hfa.>*..Sh.....7..=..........p.J.....b.o.....R.}..xD...G.m.a@....z(S.V...x.._A,.eg....C)(4..=q.P.__.K:!!..)..R..*.C.-......!...&.....^.`.h.2..l..}S....1....;........6.!...."..B....1..D.n6.[.`:qnzz...,.(......~............v&.y.\+.G_<..V..+.P.HR1.`.|....H3...;...k...W..~n......(.3.y..+..Oq7..wS*..`.g..v.|4.H.vA......?G.x.Kax..g...o..eu..M..x.........`Ht>..QT.j...M6D........|F.....?v...{~-.H.f.`..&Qo...3......`p.n.{....OI..)NY..D.....s.'1<]...A.@.{?.z.l....8.....J.M..aP....@.]..QHy.....4..M9..6:...U.]......Pz..........q......c_.P.K.2.m|....t......I..Z.q.t..=+R......pu....>.W4r....?...X...?.Q.........?.M...E.Tx..$O...-.q..g..c..~.q.S........u...h0.2.B<#...+6s2..J...}....o_...B.#...:...jQ..;..YZGF....Z.0.....p..(9.. .f...Z{n........>...);..o.....h.+%..ZZv. l.E......5.vi.d....YE....*.J..].W)...$..#gRA.ef..0.....N..;...0m....'.y........3}...H.TK.G.w..u.L.<(.,1...e...:

                                                                                                                                                              C:\Users\user\AppData\Local\Comms\UnistoreDB\USStmp.jtx.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3145964
                                                                                                                                                              Entropy (8bit):1.976362413661796
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:/oEuwwVcsivVKm5zzTiWnt8Vguw7yRJafNC2bbd04iG:wEuZPQT5t8Vgu+maV902
                                                                                                                                                              MD5:D0EDD9198E8DFAA829FA3F2EFB03A546
                                                                                                                                                              SHA1:8C29625EC0E49C4E4FD92BD714EBBB432C1D1E1D
                                                                                                                                                              SHA-256:17DECC5AD456DF8D5984B0C194CD05DD34D35AC5887ED447D5C6B1A533DA16EA
                                                                                                                                                              SHA-512:78CEBE584AA29F6E21B013C1AE8715E23AEE8F46BF4C854F1176A7E68392CB3B0121E339FD4948BAC3E2B70CDA055B80ACFA85904CF542B158CB05FEA8A2210A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:U..[86.M_2...8.2:..P.~......L-.`....J.V...}....+.....`..I..u......zr>g.R.>%q({K<j_..v..ng./.A../..#..;|=s.A.d..`..J....4......=.W4e.3..r....#o.*....@'.q....ZR.6<..........Ic..h:I_...)YO..Q..b|.+.d*:..9x...\C.j....u.S.<.........=A.........~3....!-...x_.R^.Pk.t...A....s.X.. ......1.B.<".3)..o....N..Uc..c..}...z....((u...A...4.(8....cr.....j9..s._.7*.z..D..iS...=J..4.c...1...."-.A.*[W....S=y.f.L).%~..'.2....;...z....rq.t..........RO..5..vb.+.....0.~.[.zkU.{..aX..C..O....%......d....7.868....>B.A.....!.)....".A.....w.........>o...4....T...i.Dazg.....z........*.....r.....(g....|7.~|.H.:.@D+...0jp3..4O$....!.7..../-J.\...@.....T...<;)..4...$Z.o.....Dlws...Q.I.....Xp.!...R...B.v$.}...l\.PG.E..8....LH...`J...`<>.....~G#..h.U..a..........y..............~.......n$7.,.....tF8$.I.........;.x2.'?...G..(.>KP..9...15P.T....8&k...a.YV.....k.}:N.Ob]...H.x1(U...;.z... %?4.>./C.n..q.1....,,.....jst.V......w+......3..R..tD..t*.n....C!. .rD....@U.wE...[F.

                                                                                                                                                              C:\Users\user\AppData\Local\Comms\UnistoreDB\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Comms\UnistoreDB\store.jfm.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16621
                                                                                                                                                              Entropy (8bit):7.987862597177693
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:W9tLVTPti4gW/k/RIhk+rTqWI754xTKMc29SOduE5hW1ghxE+:YVTVql+rWZpMR9jduTuh9
                                                                                                                                                              MD5:33F96CF1168893E019579F244B3C70CE
                                                                                                                                                              SHA1:BB9C8247A1A37BAE9F666E9F998FCD472CCD1975
                                                                                                                                                              SHA-256:68746681B3CA1AC35D0B3022F81B4465387050B537DEE525D6FDED58DAE986EA
                                                                                                                                                              SHA-512:8407860D6D6578E9879863624DC84B6897CA81DE4600682E622D5A20EE362896F15C7B56BE4649A73F27CBC51F879A2353C4BA77E5C7D8A323A4D1EA93E8FCE7
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.^<|X&B..j.k.X.|R.j.....U_..p...]!.h....tz..&Z.}>...].D..}.SHN..I.A.....R=..K...[j.........#.m......O..BYQL3..p..}...F......A......N@Z.,.Uv...8pO...a..................pg#.+|.'.v-U.d...q..+......o.y.t...5.....=!.B..;.x.7+....z&6.b....rn.-+...X...t.@..l.....{a.py!..+....v,...T.K.U.V.X...fd..R#.....4.....1..e.....#.; ....8.K...a.z..=..5.z56y+y.....x.a..;.....].5C.....Ke.2..,L.B4.u.H.v...Ur..G.9+1,...;...?.N..A4R,...q.M..6..2..<.*...../r.>B.^}.{{...K.hJ....'...,..&........b.z.n. ..............m..........p}.....2.=.c/.1..^...!..w........l..'RVC.4....@r..B)a...M....W....a."....w..W.v..\>...`.........0E6.).kI..t.V.!..m.2uw.g...C.>Nk..{d*..'-%7I...x.....^..I.... .O....g.)....@-....<.D....bj...OSN.A.iE.P..sO)3........G...X...}......J..5;.\.[l.n.YB.Rv..y.....+.W;.Z.5.3....Rm.N#..s.]y.\.Wwc.3Y...#{....}[..".."8.l..G..!.2.&=c....B..5.cZ.$.e....-ar.y...>Yk.'..U...jV.#B....GK..\.c.>....W ...Ky.N..@.s6..9..s^Ol6..-........J.....4.0..B..|.C...@6....dM.

                                                                                                                                                              C:\Users\user\AppData\Local\Comms\UnistoreDB\store.vol.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):5767404
                                                                                                                                                              Entropy (8bit):1.39650383813476
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:4GUD/EL+NfjlbKHA3Jh3zwavj2Q7jQs2iLwfsmd4/R3b0l:4GUDcLCYyJh8xg2gwUmdoR+
                                                                                                                                                              MD5:1BEC9FB747910322EFE4A26840DB945B
                                                                                                                                                              SHA1:4973F0FB0D8A782771B300408E42376435FCFA6F
                                                                                                                                                              SHA-256:27160F005927B860F840175395F6D1D6201B50919901C6BF637D12CE588B5286
                                                                                                                                                              SHA-512:B7FB1601C283210AD2EDEAB6BBAB307EFA277902A524DD96EBA5AE1C74FE12D458414266CCE877253D3171F6DEA247C5274B795A33D00DFD98FBD334BB240541
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.(Y.J.c...;.....T.&.i..w&.%91N..*..pw".."Y*.]2.<.q..6.fV.YF..& .mF.).{.<..X..2ou.a5..x#Iqv0m..K.*.L.........V.@.b....Ag}&.Uk..h.....+O..b.h....{.#p[..^h5//.O......n.V....X.0..7...e..,.....rH.`....]...d_$.c..B....S..b.}...m....N.&t.!.I.-.9.Q..y)&j.94.:u..,..c.>...)f.Yk..5u.Rp..-G...H..V...k....?#vau4...LB^M.V........<....@`.V......iI.#....G..6..Bj.r./.........U&..=.....~.2..Q...Z..j58..,.!...Vq. ..{.....;TT.p.$<.....]8..<.`.|UH.6...P..gg|..,...9.U.3.V[... ....0..e..?.}xI....^..\..0.HEo...e....;.....b'..L....l.=.wA.....F..|.4.Htt.|+T1Cq..tV.-_N..<.`.pF.vYh...).;6...P.D..O..1.9....'eN.;.=..1..a....x.P...5.q.....h4...n. 3.hZ.......>.\..~[B..C./8.(A......ms....y..D..Fq..;.{iL..X.....s................z...'x.6.E*+...$..i`eY.w.. XH..j.=....{....}.....S-....._Y..N..R<...x..O.k..1..P...2x..E........6_...".Kj...X..3$.a0.s-..%.a..;.S|...9/.;...-..G#...........)..~..qE.U..t}X.....".R...X.9...H....d{].D...Vi..L-%VX...41agy.^..E...S{..V...yvaM).>

                                                                                                                                                              C:\Users\user\AppData\Local\Comms\Unistore\data\AggregateCache.uca.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):248
                                                                                                                                                              Entropy (8bit):7.1535171772002295
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:7nntc5mTgNUsCg4Hp4a4XjcPVgHju9zcgsScMMUnK9Y240pD:y0gGLmzQVgHjyt3O
                                                                                                                                                              MD5:793251BD18661890CF005A733B1DD700
                                                                                                                                                              SHA1:13F05E2FCB07C07544ED3EF39BCA05C22E396C97
                                                                                                                                                              SHA-256:44C2A3C67EC613EB71679D44B05F8AD5AD289B9171B99C67850AF7A2D257D3A9
                                                                                                                                                              SHA-512:2705EBFAED8DDE7CFA0CB0864340E94B0C21DBE959E0210029795EF7B27B5620A271E22B381F61CEEC047E10DACEB40422B14E40B89ECF0C7C3E615B8CC59CAB
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.M.R.9..AK.,o.y......R.8W.h...v... .v.t..j..xw.I.X..t.?....2~.I..Gk7L.7{Y.....Y/U..........H....V..._.@.NW`.^.n..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\Comms\Unistore\data\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Comms\Unistore\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Comms\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):5120
                                                                                                                                                              Entropy (8bit):7.965531174078337
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:5jfxCH7aa1KjkfFjnkawhKCtrvqKkIy75mn9n/xQqvi9A+:5Fs0INwMqtkIy75mn9/fqC+
                                                                                                                                                              MD5:9A1B65AFCD51EE0423037F010FC7D310
                                                                                                                                                              SHA1:96F9F8C8ABBC5A716652173717A8140D41525C90
                                                                                                                                                              SHA-256:7AC6050FA4B7B2E9EC3BBB428159140A37060C29C22FCD2971E02B7CB23B5303
                                                                                                                                                              SHA-512:211D72A0CF8EB56E8B14FBA42981C9DF09EEDE556281C687F9CBCABE99B5177F1AB69B53BA368A334A5A695FABFDD751AA69082DA08C1C3AC262FF157BCE56E5
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:...;..B.r..g...>.O.........m..zhu.P....E^.!.F...D{..0]t......D.\.T..M...@..e..H....X.g....e.}[..I....`.....(m.....e...a./b....R.boPT..4......>..m%2....~M*.,...?K....l.p....I).RAgbt.....x..k1.T(0..#8".,...-....n.Tt....TL..;....G...5k...3..Hn.!..dX.~.a.'.\h...J...'..j,......_..>...B.:-X...*...:{{]%(f.....2...2...m%.(?...rw.h...8......!..3...Q.t..7H.,.J^`fG.K.D$..)..I......]5.D..Kh..Pd.....e.}..p.#...[.v9zS......|u.N.E.5_..........1......mjo..].]...w.p...=.o.$.,%m..t...v.|.,.i.N;_.g[. .|.C!.C.U;L..J..q..].L...BUd....).=.a;.S..`U.g9...1.P7.:o..M..... .O.....,.H.....[.m...r...;.Q.z..c.M.k..!.C....,G.Z.0.zr.N.f..P n3*t9X....a.4....e....o...9.g...L..C.....BQ.np1.A.e<....UX...e....l..9..vY..L.@.....ci.V,..q.(.O..q..$I..}r.5.u64...\p.....k.z-...(.e".V0.4...a.1..;a.\...r..K..)M.-..y..~D.k...y...8#...7N .B,0...E.R.../_..M........U$,z..2.$L.6.Z.=......O#....}.y....XW.........|..bs..(...1..._......%.O.5zs..[...{2v)D..Vz;.U..H.c../.$....IzT.t...o?..Pn

                                                                                                                                                              C:\Users\user\AppData\Local\ConnectedDevicesPlatform\Connected Devices Platform certificates.sst.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):932
                                                                                                                                                              Entropy (8bit):7.804385864023954
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:d0G7D8oysSK5LDzdBRCia2XjuD8+Ws2WivhRT+:CG7d+K5TBa2XjUsD5RT+
                                                                                                                                                              MD5:432FCBB9C6DF31510B6D203A0F4D2679
                                                                                                                                                              SHA1:7527F17D739C15607F2F09F551C8B051131343F3
                                                                                                                                                              SHA-256:2AF195E5142DA7AA5E19564422573C9ECF7D32CFD476C945939B273583E92E88
                                                                                                                                                              SHA-512:C9953714BB54E3A37DC6D4DEF1D9BDE3F656054FDFD9D947CA18A0ABAF10C873800F829AD120EBC5EA30BEBE08F186874865323E5FD5AA15F2020CBF69DBD593
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:5M...4...#.D..JYY.U....H....Z...4..2p.O.J.l.&..D..:.ct....%U.rJ.,7KG?H=.y]~vL.,.$.....(ro.\d....6./.s.....>..I*.<.g.....e..P..U..B...g....!.~m.k...9]..p..n..2.{....+n.Hf....[..#.>~0..v].6............[.k..M....\!.."...mc...>a.x~..Q..t..n.H.#.m.d...{..I....P.k.-7.........2l...W..3q......M.=.j.q....o.S.@..R.I!Dzwg...D.L;H.o..j./.e..t...*.W.Q.o.T.M.u/..F.BYp..aN..H..&...#...7.........X.NL.&j;....#.......k.<.$/.Be.Oo......Z.%}.......R..p....|..|:T.....J..0.]..A..R.O..3.`.&..K.&...jY.:.RJL.d."..T>.&.h.M/f...].N.AW..........i..@..2.......z.....n=..Y......].A.......V.m.{....L<b.N5...:..H,.}s...".#d.+.%D.].1.....k.x~6.3I.0.9..*..,l....,.k.!<.+t..s....LoEqI......\nJ.5?[.+...v.>.B..F'...m%M....5VrC..$^.S.....lQRe.....C..0......E.g............!>.n[~..ZU.u.h8........X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user.cdp.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1208
                                                                                                                                                              Entropy (8bit):7.843336557941264
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:8hqw2+oaSkkPWrK8zMNXS85jHe2QErkXBqL5pej4c/dkkokCM/q+:2xgPWrKoMNF5jHe22Lo/My+
                                                                                                                                                              MD5:E0D521E1B0A157ACE2393A854EF724F8
                                                                                                                                                              SHA1:3B5FBB68F49BB62952471EBA99D64B508C2A2804
                                                                                                                                                              SHA-256:05B2DA6FC014D14695FCC5EDF57B18117A61FC5DC29ABFD3B96C7053F095F106
                                                                                                                                                              SHA-512:2EC726B1330D40455A3531077765F6F92EB91489DE0D8C19E691BF705BE7B1E5935E6DBC1A8F850AAAB75FFA674DCFC082632AFFDFCF1D8F91EF84A84F6054D3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:Q....n..jl.`z2o.KC..<3..Gu..A..P.Jl.....f.,.]Rd...+.....M.y..}.'.Bs?9b$-.........<..2...rP~-..........^=...b.........i..v.p.Cv..4X..v/..vW...;..,..EHv..z\.z^0..!M.@*.e...<...WW.K.2..l9sj.....>H...?.vH,S.J..O........CV<C....P.......'.Dw..zw.-o.5.....'..8.eA.%.=..dq.S.[.!q.o......4.....P...+..+S.^h(..k.?.Q H&...t..'..(..2..S.if.E..d......\:.G.,..H.%..".CK.f.l..I.Q...Y.......2.)..&.}h....Q.)l..lMF=..?q."..oo.4.j.........P..+}IH..op..0B...-pE9. =....._M..;I..W.....QPN.u3..1_..U..l..n.C..O...1...1N'..K...L..".$...........F..|.#.&8.K.*X.n.....^....#..E.X..!b*..:.q|...y....C.x;$..I.dl.oE.y..<.W9. .HX..6.:...y....^......@iA..L.........[.oo...P..j...Z0...!....e.m...m.T.l....c.!..[....8.%%..tk|........-.$n..2W~..U...G~u...O9.....h..h..).a. .x[..)..3.Y..X.i.7U.......1.#...@.._4........n.xNEI&.1.^,..S.....T.c..`]2.u....U.B...S..0....!Sj.@..s.. ...#X.I1q..TKb..X-gd.p..G@4X....f.S){s.:.4.B....b...{.2..C...z.<.8.......M;YE....I8....9.........)../.]b$...ct... .

                                                                                                                                                              C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user.cdpresource.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):303
                                                                                                                                                              Entropy (8bit):7.313052511537394
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:w0T3QSX6arYVgF1kCR8DfyJinKcgsScMMUnK9Y240pD:wzu6k6Pbnc3O
                                                                                                                                                              MD5:15D02CCFB113F3C9B097187724A01B29
                                                                                                                                                              SHA1:2A56EE314104CA12FB05D66EF876173217C8B0BE
                                                                                                                                                              SHA-256:E085E6154760F3346F5687CBD48357D9C8CB6A563D15E88FAD834CA25037BCBE
                                                                                                                                                              SHA-512:A84B03C0ED02FCBCB304D2542017C666759B245DE7CC85F81328BCDBF9B59A19538C06E3ECC0F9BD48A410BA6A0F7AFAE63BBF9221183B1A927B574C197648BB
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..;..q....<...1&.%.+..C...#...>.3K...i..gU2...+..P.9.........)../.]sT..9.B..."n$.t..i..xt.I.w>...#..OFG......&e-...A.~.4.0..|....?.H-'J.+Y..<.q.]..M.3<..q.AD.b's..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db-shm.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):33022
                                                                                                                                                              Entropy (8bit):7.994254861929114
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:GrjAAZGOuoEawRlziLSVqg4kOZ7bqzYNM26cxhEz+sC:254oRMNx4kOAzL266W67
                                                                                                                                                              MD5:274FF63CC540DB00DBC896D867DAADAE
                                                                                                                                                              SHA1:500E226B0D510EF6979725549C636FD942B2D38E
                                                                                                                                                              SHA-256:86C1589E713B7C26BBABF7E54544ACAE6A5147D745E195C672FE7162A7844B86
                                                                                                                                                              SHA-512:44F4339626DC0B1504871867082EB869E2885F2483A8718C4E2469AC36A1AA8AB0D807952A2E4B123DF7961AF918FCD7E5630079382ABEBEA2F5DDE6355DFFBE
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..R....c..p....:U.....I.X...J.?.d.7.4..._.AB....m.'..#.X......3.._D4v.....=+f......Q.#.i)B-....{..vo..U.bEuOL{S.x...L8...x.._=.9.....T1.E..uhL.W;ejR..`.\.....7.X.."....z....Z.sS|.0.....g6..~;5.}.:.X.U...&........`.% X#H....E..$.H.....\..2Z..pO...O....[S6.v.i.jn>,%.....jHG...6.%...Q...J....X..[ZK7.6'.........n..........!J4g.*..Id......N...>{....&...~.`.{."l.I3.hs.hYx).V:..:."?.h0dw[%W..J.?......c...iG}hs..6......(..|y..hu.x.WC#h....,...sa4....M.k.%b.a...Y....||.....W.5.p...do.]|. K|........9..z....b.fa.?d...2.x.GI...[....#Y..J ..D.M.....L.NMy.g=.0N.?....?...s....4.5R..l.oR. .%U8B.v.X.oI..y.K...h..?...R.%.M...B$."...CH?U*..l.L.iLj.x9..r.!~`.zVC....h..d.A..?e.._N.b2s.....vJOJ.x2...=.B.#.,.....<......u-._3.....u..i. x../h.z~..E........<M..N.._.dA.Q.].?......6.B.A.=+V-.8;=.22Xk...M"....%@`..6j6...C.\aD......!Q..F...[_.3........V......d.X*.w.G.C.......:...e.4..|....:.";aA.Ubafj6.K.C....;Ow..,..m#..........-..9k....1.+zXXw..t..T"...[....+3I...j26]{A

                                                                                                                                                              C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db-wal.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):255
                                                                                                                                                              Entropy (8bit):7.1440276033813035
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:ZVTybOqekzTtQQ1C0+bLWV7cgsScMMUnK9Y240pD:DVqeChQmv+bLm3O
                                                                                                                                                              MD5:6B012FA3BC83DBFD16BFBD82ED9DD8D3
                                                                                                                                                              SHA1:8A4F4738664B7FC016B094B6EAC8FDD324582454
                                                                                                                                                              SHA-256:F2FD1B79C75D6C86B074565B240FAF8109D36655196F1631B69A4568F83D4D6E
                                                                                                                                                              SHA-512:05BB08B12199D48660F21585670ED0C47F1E5DFA073E15EB4264CB4105F77AB2A4181949F522FB92D7B256A51AFFFB25645BD061E5F160F32EE1DAC5875BD53D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.9..0...........LTN%.;[.../..S..Y..i.xt.I.w=....5-Q.....u..&.')6...^.v..gu76%."\.Ui...B.4...j..3.4PYn.....uz$9..y..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1048824
                                                                                                                                                              Entropy (8bit):4.9824303273519375
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:njP7d6qU2QTMoQqZlizg4R1smT66gjR6H8En657Hvu:jDd6x2QPQqCzg41LT6DRfm657W
                                                                                                                                                              MD5:3E6796B5347542020BA13586D0C3B716
                                                                                                                                                              SHA1:C5E8553F3C5FECCE978A1F973DF1D38A52853C6B
                                                                                                                                                              SHA-256:5776C7DC342A076CFC0F40134A8EDAC2075BADB0193E8D2008A8FBAB682AF0F0
                                                                                                                                                              SHA-512:5E985D5E7D7D183BCF65E0252315F3A85A63E467E5A5837F8C162A63C898223A52339C29D979BEB139C56A170FFFD3CE4A1E8698FF7E264975D3BE59F7726D20
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.p...O... .........u...^qQ..X.].b.p..^L....I.je;..;..].:..r.t....:..Iy.....V....Y......uL..%k.\ ..=$.L...;.....d.....0n..-m..7......j....9..[.?.....]Z....+.._.?[G........I...Bs.....1w7.....)..c..p..g......lh.K.f..x.i..iPz......k.B-X.z.......R....Mf.vufs..G./e9.Y.2BS9..R."..V`./n..C.....z...X...w.V.......`r9..-.vL.7 H....Z.....q.........iPp.....60Nb....zL.....h.k.r ..j!.x\==.)...!..Z..2Nr.8..Qe.......@.j%^..U$l..q./...=.OkDLm....'0fz....Re.Im...M6.]..\...eV.../a..'.....,.8.. >..H....E....1...#d.G....x.w{......y<XKn.t....K.|{.R.D...=&.b*p,.'^..eD<.D..,O1&..GYU9).:...9..#mc?.ja....d3n.U....u....&..V..fN..yO.....]\......X.............."CW....=2.....B.+...y1=..!G.O.S#sa..x.|..eb.o. ..Z%.........!}jKB..-.@K..-..u..H.{.[....M....,..t.....y..2EGL...Y...V..&.r"...Iu3....)\lu.... *k...X..h.E...r.."......fs...!).....m|.f.> ...5.l..Y..R.d;.."1..^.W*:.G.].8..Kf]..1.S..WZ..d.n`....sX..c.<P.t....6...&..EC.n...0n.....:......#;l.-a.K#?.D....M...u.3

                                                                                                                                                              C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\ConnectedDevicesPlatform\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-651D36B0-970.pma.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4194574
                                                                                                                                                              Entropy (8bit):1.5380312197707369
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:NFGLjpRxfgjSi+Hsvvzf6uEBQ0NDfq+rq1DVmHLveSQ9z:N8vTRJHsnzhEBJfqzDVwvW9z
                                                                                                                                                              MD5:9B54F1C3194343A98DE0918AE189F067
                                                                                                                                                              SHA1:D12C57C207753091D048C4A02B4C20378A8EB4CB
                                                                                                                                                              SHA-256:00FD0897942DB53F7AC269081A9657EF1A8D4261347A56C3E9005A300C038D43
                                                                                                                                                              SHA-512:C23E44F3C5FD996BDB26611068499F726F49D6CE3611123117626E994E710B0285E9595835A3800106B0E47FAC76B4ACBFB7688C2697A73E6C90998A59CDFA29
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:u..$.8...x7...FU.C...fH.#W..o......".2Tq..l@.G3.7..S..}..JH..y.m...=.X-.c..e.mE.-Bb..%.I.4.'....;...r.JM....1..-.;......cV4.=.!].CLW.....N..V"z..x...^.B*..x:.s..-/$5..v_.O.7GZVa.7..].8..\...j........(=.....x...K...m.OfR6.... .g......]]J...;..j~."a".S*..f.].^W.D.B...+....=.a...{...3...J..?~:.f......+t.....u........6...^..y4.........z.Z<.MT....j!.. ....{....=2.mN..b.nn.e.l.[./-.OQ5...x.t...g.jB.....p$.4.%0m...&.5n.._.)....\H..........9..Q....l.(q.J.O..}r...#K.h(N..y9.^....W.[.P...'..S...5N`W.g.]].@c..k..R.l.$.a...h.QY..xD..8.......0i3.O...lG....=.....P...=.<1.A'Xu.h....ao...s)__.N...'.!?.......w..e....-2A..n....:.ce...s..>.C..O.}.%.ATM.rw........4...O.....0...L.0f..-.4..M..'.%.L.O@..*>.W.....E.].x..R.n..oy.^.O.#..?..j...{.@.X|>....Z-....m[.y$..e0F..r...r...gL...V...t..s.Jb...=ka.......[w......s.J..b.~,.j..X....=..ubn......V..J*.............@.|......9fpE|:.=.E..Sv^P.}A....;.(%..U.4*.WB...6.Y..{.^..Fh..k... .I.TH.o/I.;.E<.bOPSFz9..~Z...v. ...=.m>

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-651D45E8-1230.pma.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4194577
                                                                                                                                                              Entropy (8bit):1.5381953513245783
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:n9segKQv7o0o2xBArcOE3SAclPHYqSGBGjZGk8e7BdxWs5:9Tmzo0olrcrSzHYgYKe7BGq
                                                                                                                                                              MD5:9A5AFAAE1C810414EAD810516C5B4507
                                                                                                                                                              SHA1:9D2BBEB7BD28D04AE929492FE86527AF5358ADBA
                                                                                                                                                              SHA-256:0A9EF5FD07C82FE663FE58041D4ED5C7133DCFED5AC53C12DE108F6E5CE1AEB5
                                                                                                                                                              SHA-512:210C02DEFABAAC61BA4E1E9A87764EBA86E0CE5596DDDF2CFC3188FF28A96C3F04A4F1815326904A43CF2F7B21D3D1D9D3903AD176EE64AFFA312CF22892A207
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..&H.^j........t.....G...L..<...s..j.f....7^@......Q..Je.u2.a%n..F.U..B.$...D...~.........A0..........xk....F....?.l...........8A'.2:...F.|.;.R.......B.<...=k5....6.}.-.j}...m...WY....\#N..B)....QT.q...G....".5~....:}.K...b.rx'k..Sq......2..{g.....'..o1d..4...U......C..b.4x.BJ.r%...74....`.F.:..X-..F....n3c@...o......X..kCX.#..g..$....,+..]...N...s.V;....?&....$...:...*.......".^.k`./.=U.1...+.gk8...0.#..'<..J....N8.........*.....<R..j.Lu...9........[T../U...0-p..7X.H3.".F.j...>.C:.......O...IF_<-Tm.)=..m.*..&|MVp...Dxd.k..!.[.......r.+K1....f..\..9/5M..=<mA..M..XI...P]..@=3.]G_.......S..X.p..c;..,'.D...o.8{...c..R.%.y....J.j...{.3J...9?d.~.&....B...W".r.\.D.i..'4M.D.+..........Ql\.....gf.....ys.J].{n_..p....!Nl.......a..`....@.B..N......,.F.b..;..pd.....a.CP..*3.?).A...@.]...Q*..h0.j.C%....4.Z.GZ....K.7/......'z..QW.]x.Mr.e.KE.w.......`....0...@;..|.W...a.NE.8_.......F.{.y.E.H.jJOK....g..%4T.,f.A......>.j=V._T.H.'H.j].?....XC.......

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-651D45EC-1900.pma.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4194576
                                                                                                                                                              Entropy (8bit):1.5381930524372394
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:2rKheiN7HHgBzO1dptTyjizwvM9A3t3Nv72e0oVn:2rJipHAsntTWjNvaebn
                                                                                                                                                              MD5:BE65984DAC41793B3BED94F50BF113DD
                                                                                                                                                              SHA1:0C2BF008E454A1B0355A3AFEDE41E8F496378E07
                                                                                                                                                              SHA-256:A29805A1A22FB5CD35F90D6E01D894E437341521D283A3C66F1BF3C0EFE99993
                                                                                                                                                              SHA-512:5888EC225647767DD266DE0818410C4D87E0732B02CD133097F622D080A7919A81CED7598EA67299D6DE884C38C5DE0F9D0346CE37D5CA4E9031CD878FF2371C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.$j.`l.P.M4P......Q.E..Y6...-..7\Z..j.....H.....7.}:@.=5(.?f...Bj.E....-..K.?.8rp...9.....i........o........H.)d4<.....2k^)p#.^z.0j...f.........h.....D.1"..q......?..4.....A....J...5+....s..@S7..D../..OP.z.\..x........`..X...K..v.-dV/.(.m.k.X.5ge,.&...w... ...b..@^..J...G.NI.Br.NX..=v...t9r>..?.8....k.......P...O.}.{.Yt......7..dy.P.:{...i...1$.......W.vZ/.p,`..i.A.}.\...)%fO..i..4.c2..Tp."..J.L...Q.!.AC.w..8y.....:.T...<....r.M...pme....,yJ.8.._..l.n.Uf.t..1.:.....N.|g.......d0#......9.......D... .-?}........!qn..O._39j.DG)`5.O.{...#....4.N.`.F.n....B...#.V..~..^.rp..b,.xJ..a.&;..<...I.3....Z.]f..&.j.`>.u..]....._.S...;..J....p.*<...F.....j.......G.j!.......Q.c$....(.Q.......ylj^........`.?^S^p3Y.....P.<.a.k..aj.....B...XK......c&.-..`.5..!..Ut\Ck#....:...........C M..'\w......q...N.I)j.NM...){S....z.yX.s........&...... J.<..v.n(..........-....R{...M.k..yP.....y:7..M$M.E....<[.v..9F..f..Y.eC.s.^..U.+D..l.w...UW.'"..&......r.

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-651D45EE-1AB4.pma.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4194575
                                                                                                                                                              Entropy (8bit):1.5381274016576412
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:WVyNAIxOO8ZMUlScOkp2FKLlH9DpN0PNw7fYAB4:WVVHnlk+70Wz3e
                                                                                                                                                              MD5:B8FB1B7C72DBFE05E77BC6E8ED9DD62A
                                                                                                                                                              SHA1:F8CA805EAC92441627F0001DCBC24E17C6472C5D
                                                                                                                                                              SHA-256:F14B50C5BA567E19B84FC6640518E745BE4F140AEDE8A079399566964CD0AFF7
                                                                                                                                                              SHA-512:38428CC5EE3430098A33A25B3DE93C2D47FAE515BA301B3D3686193A584E4046A4A3F1E82AD83532113FAE3A820FCB2EA1D6F60CABE11BDF4B0E61ADDFB4DB27
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:iE.Z.S..1. .xK2....Cy<..D.B.W..~....A....s? ........{...q.X.hS&..46...q..t.;OS.v.KX.[....F....V.gi'V...aXBN.qW".u.x]......d...?.._.v..M..q#....x.....Pl.N6.v.G1.D....d..:.......[..>z...'....1....B.......:^.K3X.8$.]..L@....N....qn..Vx3.4..F...8.e.>UD.L.7!..=...K.......,...J..$z".-......+......=N...../K....z...s ^......}-...|..7B.K$.LH.RG.&{>HO.......1#^\Y1.F..P.l..#_X.P...J[Y-g.......IX$......T...2..}.o>.....q.ib..*a...L;..,.s....z.1jS...!.v<3........!.....v.$.@.x8.....>.&.Q.Nj...Q..TN.2..J. !...Wo......7.q..... ..wWY..i.d...6.So.,;......n~t..NAe....3._......Ys.h.{....h.$.....e....l.4c..s..zs.YA...G$.o..K`.t..UF.ly.......ZF..h..BKC.$..y...2..b..........r....[.......... mlO..ef.....R....m.\"._....T1...a...../.7._'.l0/..R..S/z.....h...b.RS.&T..x.!l..R....~..@...'.gM.QX.w..\....2...[(....r.[....o,.'....J..L.2t.....O.?.Z?...$......(.A..H...j..(.....t.....(....V.3.td.g.".J...rm.c..s.D../.4......TB.1.>.+I.X0..=1...-T...'.4h.l.uR......

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-651D45EF-16F4.pma.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4194575
                                                                                                                                                              Entropy (8bit):1.5381345460974962
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:csmw5+UjbgP/IE1pJTjfw6G+vNqyNSbPc+TIdeTJEZG:pv+UjbSI4fwMvNqyNcpcIWY
                                                                                                                                                              MD5:20DD0F4E1C3D4D9C37F269BD4C6E86AF
                                                                                                                                                              SHA1:BEF50F0D643A4AE3EC04E05A13A37ED086F8983A
                                                                                                                                                              SHA-256:AD8FEE939D6A53B743BF3FFDA2F6B51DA3F75D1A31E74CFA1392A21E899C2B85
                                                                                                                                                              SHA-512:B0E100E480B55DCF93B0BFDB24575447EFC957EC511CB3C39CF6C800A39913BAEA596BE7348913482E1CD374D957B5637308F928D154463AAEDC7090B3F7F5B9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:5.&B.k.J.....I..M+`.Q...R..7.,.xe...2.K.=2Ah%.}1.6E.^[:7LN....D6...R.ra...M...3.ek.3.....f....\.....Y.n>....X..v....8^....dRF...V.#`....7:.o._.*...4......pE,....1.P......O!..!``Es:..2.[@...q....r..C.0b.Wy!....Z:.I.}B.wT".....J'.@......D^...=If.&.x/n*............ ...C.At...5U.r...\...L.U_..q..7a;.5~_e].YK.....@...PK.B.(t&p.>..c.f....zWm.....TWC..v$.y..;4.4p`.5B..R.o ..j.....n.jG.\3.6. ......8(........d..,..^.N.[......b.......`....u9.Q@....s(a.N.)...!...CL....y...8$..:..v....l..#...}.;"=.D..7#).$....l.U.9W....*f4l...y..T.S..*lk.....././...O...9.>.Z.CxIr...r.f.0>..y..O3.V..l.C1...U.x.D.g........E.GV....V....A..~...)\O?.J...t..}+<.c..Iz......|..,!2.kSG.....+6.2l..u..]...E....j.z..v.`....?..RbHb]Z.rF...$$..E...K.AV.X...S....R..d.4eU{..m.[Y!...W..i.A.fl^.../u.Q..e..j..ti}.E.x....C..P.....v..J1.1.a..&o..]....Y.?. .r..I..|n....w|.l...%...._.mg..oU.f_K.z.a}p....z:.5.Bz.9..\vk.:......em..9.*.=b.ca}.[.... ..C.._.EC`j'.$.B.Epq+.\.am.H...;..v.

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-651D45F1-18C8.pma.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4194574
                                                                                                                                                              Entropy (8bit):1.5381325881602792
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:q5DHbJYW9m75bKsTIudoZb49tD9kcayyP7e9QAbU1prHA3+/:q5D7JYR75WsPg49xayctHA8
                                                                                                                                                              MD5:72FE7427A3A52BC40B253ECBEE9EE492
                                                                                                                                                              SHA1:C8F92219A3D60AA7AE4DA865F8A1DB44A582DB14
                                                                                                                                                              SHA-256:8F25BCC38A47926C68F66DB501E4BEA96C0ACE66F9A77108910EA8542A73251E
                                                                                                                                                              SHA-512:95D83C17980C979E74D9F12B95ED7BE846CDA872AE7A9FBAACB4C6DD4475F4234E91B39BC35C272725FEF77CEF85134803C4D9A474990D4D06296E2EC55BAC41
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.8..*.g........ V.....!5..A..-.Gk.........|....vQ.....n....F,]F.7..AR.6..Ws..[..v.s...REb.4~+..r.....'Q.q...U....l7ey..&P.j..\=.J.9...w.U....i.x.[..VF.6_..T.M.o.!.6.%[...>.u...9....7v....'U.OU...J..g.(,..CG....NN{<e....y#.'.0.a.n.t/.f[....p..A..w...Y.ff.1.o.o.*D%.Oq..|..g......Pp.Hk../..'..1.1a.H...)...^>...E../+..|A!.......Jcxe.....f.Q.Q..>..$GU.1..}...3..a.. .M&=.?.z.........I...(iy...m.....O..bO....$....\z.n......q P.u..2.K+fh....V....x.=.-C..F..I{|..-...H.=...r`.k.......U.N`..w.j..l^....w..`om....>.......".Z....r.....0.....IW;.."f.7...2..+X..en{.....]..T..n..G.%Q.;.,.&P...4.?...`.........@.7.w.T.Y52g..5.....".m8.....u...{.c.....Y7...Z.fq~..Z......z*...[..q1h.._Y...7...8#_.a.O...I.....b.N......-...C...W.WuX~yq...*.<^..8j.>...V...W.1......-&...].wb3.r...}r.m_.4|...(U.E..."|.h.ak..(.Uh...{...c).~.../.u`.U.t..,^..m*...w.3....f.S..E./gK.............}..X..{.b./<S.+?...y.b}..0./..\....g....+.J..(.:......d|.<.....6..Yk":...s([Z|..a.+.V'...

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-651D45F3-1954.pma.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4194575
                                                                                                                                                              Entropy (8bit):1.538200615195015
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:pEZ2jyOF2oapo70kbKv8nnPquZrszb6y89Zn3LPi8s:yG1Xl0kvnPquRszbZQ7Ls
                                                                                                                                                              MD5:A140861933866CAC75FA1DDCDA29D4A4
                                                                                                                                                              SHA1:09333FFD03F17B315DCB7E2E7AB58A35AC9ECCA8
                                                                                                                                                              SHA-256:AC7F5AD7CCDC29C94BA0BA4855F5902DFB556851F406BF8649CD3D29659128E9
                                                                                                                                                              SHA-512:D8EBBF1F302404278B13706BE51DD575737CD45A233CDE2863482E13B7F35206653E1E5957D17F8AB2A2AA8B98E9048F7354FD879A81DBE1B26E1FA1D9DC4C5B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:...L.*GO.}...YG.......>....g..c..*.kJ.....\`H/.....-Ox..K5.....>p3+w].....M%.PJ....g.~.]v.7...2M..;N...........(...&..b..{..0*$X.s+`..3.:.X....;.*.......~M..u..ap./..^.p....ll\.q......C9Q...^.#o.$.O.u..........{u...He.@.\r@..p4...b...EK.%......3.=T..@.....{...@f&8&....v8w.o.......M....f....m.Xw..M..q...t.9....z........p.F1......!..p%...9..).'..[./.8.1h......JA..R......!..}.Zkw......r....22.;?..........U.r,;36....j...a..*x....@..^.r..+....w. ..5.z.#.Y n.T.~.r9.T_.X... ..P..uNF..;.t..].K.O."'.H.PO...8...5..A..q.v%..z.`q......a.7#.xf`T...........c.p.....Z.;.....}..,.9.../l../;..cS.A.V?.."....2..F.?t.E*=.1:d.g@.b......K...B..B.....w...g.x_..#,...N.u.u.d6...M.9....#.._.u,..t.4....u5Vk.qY'..r.6.A..z.k=.hR....2..^K...%..s7.L.X...s.m....S.t.....8.v.,.v....1.A....j.....^=.B0....3<.e*%8...s.6..yig.2X.$s..L..@~.....e...0Q?S....J...9...F.IM....-....m.b.LZ..`.4.>.]N......]p..O.I...m..w..}.&../T.e..H.._..anbv..g.8VA8y..6.di......{......

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\CommerceHeuristics\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):279
                                                                                                                                                              Entropy (8bit):7.229633342331048
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:9oRA8ICcAxDzjyhWwjnkmTlmcgsScMMUnK9Y240pD:92AZ4xDzji/lY3O
                                                                                                                                                              MD5:69EC473200A2AE45F64FEB7B72A27D14
                                                                                                                                                              SHA1:AD8B4FD00A47BB675D313242EAAE468827CAFB0B
                                                                                                                                                              SHA-256:7AD241D4815C06DC5BDA9719BDE56FF20346AFB0DF389FAECDDBB2205F772373
                                                                                                                                                              SHA-512:4CE9837978B84153F30721EDABB95A9B9F6EB38D0DF758D1FF259A4114DE51FBCDD85F84D6605DBAB5E97CEC3EA2E1231D80E8510DCB1583E6D289110E54A27C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:+..d....c.9.)b...."..).z...Io1.&....p$.99..0.. l..l...A..X$...ct... .$.t..i..M.oKV.u..O....H)..n......#)...sJ..Vx8...S.y}5..vP\96K2..).f9-.i..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Crowd Deny\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\FileTypePolicies\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\FirstPartySetsPreloaded\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8422
                                                                                                                                                              Entropy (8bit):7.977786179030344
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:9Hg/qsfxlMNiXzu2KcKMWXIO84/IiSfu+:Fg//XcR2eHwi/+
                                                                                                                                                              MD5:9EE313FEB0B509653910F54EEA3CDE6D
                                                                                                                                                              SHA1:A859EFD7CEFA75D6A8682FA0DBB5054786C37416
                                                                                                                                                              SHA-256:6A5028EE857851F78B518FA5D65C53C8C3E42CDF1856AC9533C0AB6720ACA607
                                                                                                                                                              SHA-512:8E46EE8B6EE3D9800E3F0D75B490A1CCECC2D0577F43A0A5A75FDCFB16EFC4C9FFE50FCE4F3BD3AC622ABA5B22F76DAB48ADF8A3E511A20B9A4B4989EB63B3A0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:H.....;Y.q.N.."..[K(.^Q..C.G.g?..d7.......'h....N...'6[.C...L..6O...=./.J(....9=.........1R....M9...bG.&)..3x.....,>fs.<..!....q.~(....h... '..pD...T..2&........c+...;.Q.z-..E".N.........w..FY.6.QA.o..fP.k?jaz..E.n.s^..w.'e..=u.c...8='...t........#....x:lh.?....#v(..3...7._Q.Q.....]Y...ao.X.@<u1......B.......!.........U.m.q.$.:..f_._`....,....-D...?.Jw.,..pW.......Rc...W...CG......-.....Lw....\.g....yM.z.B..t..vuJs(..7..L...;.:IW.`..z9Z..i.....K..#..............y..:...`.)..,....N..w.cr..L..~".u..t.JD"ic.$O...S.z..V......n.z.^.|....T.Q.;.l.....t#h..>).l.YN.TJ...;..S..........O/..,.q.T|...T..8.uG..i...]......*.dD....W.y.:..+U.z..Y...."Q6..y....G.)....:.z.n.2a.8.0.:7.".jz.....b...Ja......w..AZ^.F..Zt.........X.q...W..].....A1{.....S....Y}....n~X..AgZ...@8.5+.v&.;.....7.X......^R&.:^....t..6.@o.:S...+.}R..{..>.I$l_.Q.2........./"..HTgMF.....)....sG..$...5.V.',.P%..~:..m.....a....x....wv.Ha}y.._..~,.....SX...)...S...Hu..t.r..^M.......i

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):270566
                                                                                                                                                              Entropy (8bit):7.999334536059996
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:6144:2SLcQqr5xlvOKVHEiqQolHimNO4PW/KCr7tH:b4QqPlvOuEivolCD/KIR
                                                                                                                                                              MD5:680BAAB23F0C24762B5108DA8538F113
                                                                                                                                                              SHA1:2B591FD62F98EF47596F80EC6100F4BE2C3B98AD
                                                                                                                                                              SHA-256:8FA5B888691D40EBF65F94D71C8D41B4F04B3388CB50BB0EAD5D5AE9C9FB89EE
                                                                                                                                                              SHA-512:DAF15BB00062E7FB155C7722DD01B6112C6B4C19DF597F77AB53305570336CE3121E81C3CF7B070BF946915469A2E45F034CE3F8113A5C37C9EC56EC1A6F0465
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:J.c.'X)/.8...D*.%..8...{w.!..........S/5R.....tE..h]....,X.)....).......5..M.a.e.S.B.....!,.....8..].......B...#8+)..?a....Z..........-..yAL.u..U.a..[t.. ....T..Pg.F......;..{~b.(U............x4.....;z..K..b.C..X....iI.1n~..#..(.....t (..F.R....{.$.. M...Z-.).qoo...H.2x...6.l.?......3{..g,.m>....[V..=......~QK...M..e..0...QS.HS.....Cg%..{.7.........G......x.\.xL...Z....fQd.x*.D....7..$....QA.Z.....}Nu\r..FM.F...9...'...@..,.6.XH...`R].An/..p...B....0...........@M.....>Y..'._j.4...i...._..l#...l..+.........m...a......C....-P}cB...&G.Hi4i..B~....\.r.m*b[...........K..5.Lw...).5..7.I....=...|..&....|......^. .,.2...[[........w..TA5V.'SFb......!.e...ZR0....m...pA..S..G..`i.:Yf.C.&...#kY.<...c.._...]&.....qLJ.....Y..xy..C..5...Ef..a.w.....5..vO....UA.)...u........b.]..\.. .@ Jd.x.#T.M....x...\.R0..(..X.w.]...... ..q.....c.zZ.X&F+....]Z.T.%..6....K....Pb.........i.,.w..;f.....P...:.Luq..9T.o..BZ.5i.........F.._..>b}M...z..Gz.k.....J...........

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_2.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8422
                                                                                                                                                              Entropy (8bit):7.97669679620106
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:cLtPG5ySed2M1ipDzjMQe7Q9bzsNYJXzn4NTe3dtyH0/U+:cLt+5EcXjMwbzDtEO3/U+
                                                                                                                                                              MD5:06A2D413BC801B3CDFF9D457D87E3CDB
                                                                                                                                                              SHA1:C0B53B820D00D3CDE047C50C04C963819D9658C1
                                                                                                                                                              SHA-256:CA9F5F7FD0B9C77B79DBD3F9FD0B5B103DFFE3D5B57BF39B6D8851ADD86762BA
                                                                                                                                                              SHA-512:3F15362533668D172F33CAC2D6793F6D7A92427FE62C73D71A96CD71C627F026D1E639AF051C952C9CE53BD6A9DBC4CE67BA8CE05109232186268EB85B58023A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:#L...p...UA..o6)X....C.7.:..U3....Cp.-:ke..o.T..M...3..n.Ln..B.`3\....#.S}.E....w4.\..l...e:...)..,..2!T.;..H.....~.&.RoN.7..9..Q...db8....\.8..{h5+...(-.]..._.IV..9.qz.j.....{cl.n...AO..$4...f..c..N.........:.4.1.I..KL..Q..#..7}.)..:....YA[4.@T..m....{..]..Q.(......+..dS.B(.i.#.&N........M.Y...&o..K.Bo.I.^v.8......2a....S.\.2....v~...?E3.:s1W.d..W.(.Kg]..P.D......8$.$8.r...dI._z....!..Z.........~!tN.._..T...............j.G...].].Q.<....r...u2..DQ.X.}..0..J(.k>9.R...2>I7.|.......+1 e?..............wbj.s..Q......EG1.....6R|..F..R.....<..K..{.x[>...NR/.8=..n...[j..I.N&.......4..........d.b..C...g'_..=..<...'.g......g..T..8..#5....x.?x]8..x..?L..N../....[....mc.g..J...9+.N.!:^..........*....BpPv.ygs............mZ.qR.[e..Tbh@E.>'$I(Zi.A....E.cd5."b@N..qy..6.H.....S.:.......W.R.S9.8HR.....I.~..*..c)....\:...P<5..A(x......j.f........E[j1....miy.......D^....C.H;.F...t.t..^...g@..G.c..R.......=YcT..t.Sh.s_..........H.8....T..)

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8422
                                                                                                                                                              Entropy (8bit):7.976552311641477
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:faMpo/JQXGyxB0B30mEktTRlAkhdcJeVCAQ1pYCnmEB+:yMpoBODxB0emEkCkaAWKCmi+
                                                                                                                                                              MD5:49100D9D40E0CD29E72627935D622B39
                                                                                                                                                              SHA1:41FE833E893D9409EC3BAADE4F98ED1DC686C80A
                                                                                                                                                              SHA-256:FE32E25E10E466DC45288FD47FF2B0659CC8F1CCFDAD4C5292F01DE9445CAB62
                                                                                                                                                              SHA-512:01BAFB2DAB821AF9266CCD55F443ABD8F639E6E1F01FF5F14B48FC553A385E6DC273AC43049BD9D27DF80BF5265056A5F09C2AD12BAE727C18EA2D3A391C98DD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:S.ae.....5..k.8.A*9....n.~..&..aK.f.Y-<I2.<;M.i.r..:.l..w...g..,.+L..u!...S.c..`...Q. \..9X.|f.......\1...k....h.. .z.Z.....T.{,W.;...P6.EZ..*lo...@lB..,.g...aa6.[..ZR.&..Iz?..L..y^..\...;......j...zz..['..b.a...q.. {.......x...c...-..b#....6UF..}7.h.s.|.m[8a.T5.O4.=.;....2e(.......T..5J|...@..../.8...GZ.M]..1.a....U.2.jp..*m...e..*.}...6->....s..3\..(.Q.fv..|.O..Hly"h[s(...I?..d(k.&...Xo..Ooz.W.~.&..M...N.={<...R6..+...(.....#...@.$...42 sk.|+...ofx.......(.E..X.*...)..c.&...B.d.^M.;'zg..?,./....Ln......W..R$..KJ6)vO;C\.PJ...G_.$ohTZ...[.M...(L..q.3E..M|.ot>.B....}......3Y.6/.+..2{?....dw}..N...-.`>-y.]../..r....(.......99..7S.6Y.........<..H.c...S'.....m(d..r].#.....M.='.!..ya|%Y@..QO...R.....U..f.B....^......b].g.om.t......~.z..Zix.L...;?.....s.I/T.. ..>.....u.BB..%_.q}..do...v0Ge8.w.5...>.."...9..#|..4.N..0..[d..7ey.W..@.jD.c..w._:.#..........<.3r:...a.............X;...=....\|.).[A.{.fo. .i:......9L1....m..S...P.nM!.vaB...d...g.IE.&..'...

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\GrShaderCache\index.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):262741
                                                                                                                                                              Entropy (8bit):7.999336317268176
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:6144:W4R2yXPkADJfO9cyEuEnugkOW79QzIfWUkrFjQ+11Hi:WQXPTkQrLkOW79u2k6yQ
                                                                                                                                                              MD5:4EE0F8DE41E2CB96020D10C9B50318E9
                                                                                                                                                              SHA1:2658EE7C0BC3A1CFD9A7D31AA9C55C46E7DD7AE3
                                                                                                                                                              SHA-256:9934A583562F79D1DC93446283690987DFF8B0877E0F7AD2DA7882C1BA5A8756
                                                                                                                                                              SHA-512:B7F01C370A95E137C6F67635C1113C3CC8D4D75F7FB269118E20ADA6DD9C300CEE70C28C346BFAD85A71B3CFAB658E7EAA20FA3CCF2138242CB4AE531FFC9ECE
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:0.}.j9..S.)@.jF..P...f3.......i.Q.[.O.....S[.P.L.)W;pZb.[N.....%b.a.>!w~|;$...S.F_J..f......}.\P.;$0..`?T*.9...{.. ..3}*9rG.c... ..U61.......8...k.c.Vi8]>.....1ZOHO...T.\.k!.l\.S.si.#......&R.1..5|.L....=E.IS^.:.*.gP.8..~BM....Vr}v....5..3..)..0 p.......{T%j..a8...f.m..g.9..e....'7:.{..u....S.ZBH4...}X....{!0..x..H%.-..}....Q@|lZ#.w..[.*...j.....J.s..phj.Y.X...p.....Fy.6noI<v*!......V.MHu[O8q..ab. ....h:!.^....v...L...k..`?.8..r.....3?.-..\d...[[.".o.....D`S.WnT.Nik.......c.bL?X&..}.....u.8..EX3.....Z+>\..@.@Z......{.z.7..E>.q..d>a.b.e..........U".."......_.8..kA;..5)js.d;VK`M.b..We)!....ir.Ag.......8./l.y6..{......\.p..6....."}Ua...(.@..l0...{,H..P..;.....@..1...N.6.e.8..-..y..Mk:,..F4.J$..>#./H...I.>.....2...T.}.4..}.i0C;x.Z..+..X...8.?^0.oA ~.."...u..k.....\..g7P..i.z.e.d6.DbZK:.p.1...+....~=.5..}.%v..._./.G..2......O.....El..+%..x.=3.5t.o..i:z.!....2 .x?...i.v3./f{`^7....j.{.._o.@(T...t...(.&........[.H.;s^.|g.4<......+..O..........@.U..

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\GrShaderCache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_0.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8422
                                                                                                                                                              Entropy (8bit):7.9791236831010695
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:tg19tFMrAqYgrBo9mOpeMnP/FoS0LRJwUWIXo57xRvj7+abzBxSAQ+:takrAVCo9CMnXKSKIJfb794h+
                                                                                                                                                              MD5:D100738C0A94C00D71E6F20023AA2042
                                                                                                                                                              SHA1:E9A81AD0A7EC4C400D521C01D07F6B0A039C9CD7
                                                                                                                                                              SHA-256:A6AC9317083051C7927E4ABA93BFC31B1BF87DBB42AA2FA92DCA9D29A5C6C54A
                                                                                                                                                              SHA-512:2688F13B4451188E036ED8A0BE9B0EFE2B5A0586CCD05CDF098695E44E860F54029E8B181A9E339B20FA04175E32286A19E696170345FB1B63652E04E19638F4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:\d.P.0gk..%.K..a`W..........o.E.}.MD.......C%}.H.....=.....%..c......%USCz..Q....h.....*.e..p.3.5....V6.|g...a...aEV.......4I*.H...p.=...X..v."o.n'..........."..5....o..O+....sL&.Ir.......A.4..a.#.=._.M.u<Sd.O<,.g....v'..*9...]]...+0.'W2....G#;....\'..@`........b.....z....f.T..u3....q.!!=...SFI-\.q.z'.gH..9k.3....Z....G.2U.`.'.P..:........L4..M...yKc..Ag..qc..`.k9^..G...$2f)z?f.A...S..u..K3@.6...I.,.j...%vP...#.K...<..Y.P.w..>~.._.v....<'.~...lms.cOG..e.[-..'....se...>..S...Z.<.n....7k....Y ...(.pH....&.C..!-j7.j...........KOntW..jC....m.).R.hG/.W.._...7..}..x!.aW9...1.A.P...aO..v..}.MUUuYI..\z...@"...Wq`\.y.*.....q.\B.h...T+.G..{F._Uw...7p".8.)... 7|c.C..a..p....~.n.-G....j.J.Gs..o4...l.vq.M..I.2..{D3=...(.......S.}.{...,.C+D..}6....r.[.WJ..0m......b..N.P..f.Ess.u!.f.5,.B.(.G...;t....}...H.5*..9f...7I..2...v.Oa>TG.!.;.4..........=....E.(..$$..C5..a..v..K.8.....EI.n3...._$....jr........j[.-S....*.J[.&.0I.=v).{.^.#.4....xk.Ao.F. ......@Cyz..

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):270566
                                                                                                                                                              Entropy (8bit):7.999373563975106
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:6144:DZ24ouECBTeZlJoPLjaMpbBUinIbnvOMKjHZKyVULamoHjTUvYrz:DZh9BTeFoPLVxtIjOtQ3LO4gz
                                                                                                                                                              MD5:2AE038988B51939276C12BCE635D54DD
                                                                                                                                                              SHA1:9A05481B28163B90EAF87B3FBEA08386A94A25C7
                                                                                                                                                              SHA-256:DC7341D7BDD698C021688DB53BF3E7CF4EC2D69112FFE49DD892DBF7B674959A
                                                                                                                                                              SHA-512:9D05BE9806A11FF7E80B06368B8BFFC43EE8EC3B96C50440A21A72178873A17AF0AEF5BA8BE3DE8E12FC1557117FC65C9A8FE6515B0AA8D2330F616454283965
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:....v..5.......Vu..hF...d.U.y.8z...f..D..To`..L..r...c..F....-.$....B...c..q.R..Ef......`.. ..2...}G..T.....HK..@0B,T...h.........t...?.Rw.......&`@/..<.....PI69.Qs.@.E...X>.X...o....@.'.V.f.$#W)..U4H7..i.P..=...........v...j....%...r]...u.HM%Q.z").....+.O&..O....[.5.AR_.u. .5. .O.A..B.gdQ....8..z.y..-.q:...I..@PH....R..K..!.K.{rw.O<,....).v.@.A.i.K..g.?\.#...."...-][/....R..E.`-#.<..@.........:..r...T...n].R.-.{.?...X..\......hA.....G..........m.<.....3..-.A...8y..n..q.9..U.I.2.L.. 9._..2......|"..Wb8.+S.B.d.D>!.. ......K'.3.lfsVo0hn={i...Y(B!...+.}..]w]y...B.?.ia.i.A0.[4.......:.u.x\.....t.....{.V.X..e....f..e-.........@g.4..l.....T...W.7f..f*.r..q...".F..j....;.....A^.0..x7.F........Ho64.........1|..w.'3w...O/....... .E.....l...........yx...:..G.j.E....}...s.fYa..B....Z. ....#...b.e.4#YZ..A=;n}&...q.9..j:..>4..b[.RyQ....,.OR}..Hh.Q8..5....$13.......s)7.........w..;..W{.zs.......h.7..z.........!..-....9......W.j..&..ry.\.

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_2.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8422
                                                                                                                                                              Entropy (8bit):7.976668539841313
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:8jEZGDsyfUBWQxRml/ZYhvuKeQqxUQlOljo8HMklvp+:C1syMBvxRK/gvDpq6QlGR+
                                                                                                                                                              MD5:30EB0ABA7F616987839E1A891D3C1F6D
                                                                                                                                                              SHA1:C6949B0EC7541B47A76EC8B3B68D7D5C2D5940C7
                                                                                                                                                              SHA-256:FB9522C49348F3D38EBDB01A7EC4AECD0E3756265113A35C232156649D375B61
                                                                                                                                                              SHA-512:5724A6FB01B4E9DFA8FD1C069F8339D989AC6A9BE9BA81A3EC3E180B51234E71147300F949DA355FD29742D31DF911A7E6ED7665A58025872B83BB2A77854F4D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:U,.f.I.d..f.....A.=..=..@...6...T.[.AT.?.E.w....t.N.K...#W5....:.b.........Z..~........3.....8J.P..}.IJ#..ZB.R.l......".).q.?.l..L.|y..{.V..`S.].!K/x4.F..Q....a\..)w.....*.&e.O/....._3.......E.~....(QK......_\<.Amr.o...c{z......g..t.\.S.9.l...-......).5....g....'..\p).) ...4.A_..8.#.mJ.So..4..,.z..&`=...w.4..x@^.L.U..q.9f6.#.L..<..Y.g.{.-hX=k.X.f.#}-s...>4..../C...q.&.W%5bU...q..X.-.7u..H..v.V.$..*.A9n.Km...7H..E3yL.\t..i....1.....Nt...a....g..z..,k..-\......i{..IsJa..l_..[.{=\.u......Q...*bn./.d..........v.tM.s.|ww.9*.j...#J..o=.......Gu.tM.....f......M.p.ck.p..,G.......c...Ij'&N.......b.q..rF6...By..O+..}..1.....c..!Z....6.T.....pm...zV..!.$.,......{..~.J\.E...:v.9O...0A..qB"......N#=4....a..i....Q..Bw..M>..X..$.....hv..SE.e..+.(.k.%......n..gG.....wY[~....5g6..*.+......^.W.N*&VMr.....2.....B}P.b....[.X.[a..8 ...%Sf.aL.RV.b..z.O..$..1.18.(..ga..kl..S..Ng..wN._a...i...X..0...j~.e.+...i.33.j...CV d.!......l.4..R.Ye......G.@.........!RW.

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_3.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8422
                                                                                                                                                              Entropy (8bit):7.979155182786044
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:+rjHkpN5fc8+TsFJHPRns+Bsu/uAI/PPfmEXeEi3Q6rsjFv+:+rjn8+TsrH5nzB/UPPfmt3QBjFv+
                                                                                                                                                              MD5:12B868AA84A2FD46163FCC8BCE7B3F35
                                                                                                                                                              SHA1:436FCD8D6465D03CA4788721D6A95CEE68ADBF12
                                                                                                                                                              SHA-256:600DFB98A635DD6634218ED74E3E67AAAC195E010CA59DF9849D5ED6EE1E41AC
                                                                                                                                                              SHA-512:EA31E030A56A4CD04EBA2E0F321E162F3E7217E9DB106A0E79A6C3FF657CD6B93E9EBDCF8C5007538A1FAEEB1A6E309474EFB4788550700F07A81096D21DF870
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....>.sk....|.h.....M.OJ8.._..V.P.Y&...C...O..l......"...."...P....C.t...i.;......d....H....mf.....r...J.@^@....B..?...Db...D.?..ym.y.G.!.c[....}.*.)..e...bH..U-....3.._..(...&.qg..<./...m.W.o.r.......q0..Vi....._R........6....g}.X..R..V.,.k..K.zM..W|xZQ..dJD?.3.{.X..a.vh.rM.|.$...9..DFU...lM...DA.^/.O.....[`j.E[>.d.t....<r.B..A6.C(.P;...<4.*._...L.....8.A...*....*K.....[.0.?.pON.b.x....n.l.a.l\G2..,..e.3....(.....a.".....*.....G.1.S{..-+p.8.J........m.<.=..f.D.|...Z........Ay.Z<.R.r...1tn..*....8..(....tiua.%.......r.....4.g.0..\.D.w)._...-B.b.d'n..1*. ...7f#;...ziIE.....25s.....aK..0.KU4x3c.P?.r.=...}+.f.Y..0.#.vEp.m..}Q....z....5.a.$Yh..|4Aok.f...!...T.Aj.YR.../..[...*....z..2.)...D..,p@...:..^.C.3...Q...r...J,..1.SU,.:,...v*..1...$bU..i.Rn...S.a.,....1.0W.S#.}.v..$..V[.`.}3v./|S=,D....|....B1.M.J..V..G`..b...)..K...y..9%.l..,....!\....).X..[.F....p.X.O..%.s4....)j&bd.....d.%.0..Z..w.S..^.V).V...-Q..(.=<I.=.w.... )~dm.?...

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\index.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):262741
                                                                                                                                                              Entropy (8bit):7.999303148271927
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:6144:fA0kx/MnvYDCw2BhThItaqcfDFoFIhSvomwm/1kTkX:ax0dzhItixoagEmaI
                                                                                                                                                              MD5:DC2D20789C1992671FCE8E0F4C12CAF7
                                                                                                                                                              SHA1:FE991E73AB0FB1EAF8AC836B537C935FCA1BFC65
                                                                                                                                                              SHA-256:42F91C9B05230CA11349EE7772EFD9339946ED6FBEF030E74E661BA2D2977E6F
                                                                                                                                                              SHA-512:3535B0285BA4E03FF741AA278B5A9D58400ACD0DC8566ABE4B23F748AC0467F52C66605EE0521AF004B6C12F739F49D69A24F5DF6652EDB0C171D5FD3E874188
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.?C."..O-...t...U......ct0lb....3ps...q_V+s..k.....W.B4w;.f.d..i.:C..x...2.:?....Q.CQn.F.E..$B/..#.X...`x"Y.9....E.......+.%..\.(.J..Cu..-.b..:o..^!U."..=5...{(./.......`s..K.....Y....HX}...h.g..h.a.jU.j.7...d....t*E.\/.....yj..K;.e.?.&..x.;.N..#..lv.Z.:1ujZk./.{f.V......zpr..|(.0..N.-...".5...N[.....9...{..U..C.]...h..?.5.M.h.<mk.....[...=.J..........^+..G...rm ..!.}.V.z.E.....Kk.[.-<.f.K.V [......U..Fv....H..z.n?.p....8 .J.3..d..-.b..B..4......^....@..g..%..F>.v.B.&N.....S.B............P..........$.3.g6.6.3..[.....................|.....NR."..H.n...X.*..,.H.!...l.A*.....wb^%.....hs>r.....,......q.nW.."X.ax({Q9."..G$._....B...F....\._.....$.....................9..[.gT.g3{..C......#a.h.3.Y.L...O.>p....V...6...T....*_TJ.".....oH.&....~..8u..\.J.............f.....s...!.@..h..O..K..N.5.b"c.>.c........Zo.B..g....h5...&/..k....(E..!.gL.f.....D..Wu..y..5Qz.0.=ob-....{5..yFI..,...8.d.#...Q.D6..|2z...L:...H...M.^_].r..2.pS8...Jf.{..

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Browser.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):346
                                                                                                                                                              Entropy (8bit):7.369875819019278
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:gZJznc2LO6MQNG4L3bZPTG7B3Oi6BsXkcN1A4cg3KszcgsScMMUnK9Y240pD:gZJzcFyzdLK6BsXkcA43Ht3O
                                                                                                                                                              MD5:3AFDFC62C91E6643C116A0DAEC4A47B8
                                                                                                                                                              SHA1:8E3D32116803BE32CA4231EA14B30C692AA1B43B
                                                                                                                                                              SHA-256:7AD19C8CBF8B67E01CED27034228F3041B8919FC334A820FCB933CDEAED14F3B
                                                                                                                                                              SHA-512:50D1EFD0B78E5C1140D1CA380662B5F4B4007C7543711F54EB01C850F8DD2002B719FEF721A150F1C3CF8F88A870B92564C2DD78E7C08503E1BF129F33DFE6C1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:9t..X....:...%C.6...P....O.+...,.!8..&.4O.|..W.. t....*Z....S. 1..u.$.>\]-S..P.z...T..T...8.)..t..6..9..7...B.....`...Hl....ct... .$.w..j..x.J....,Q\.\..J/...v..S..P.*.M....:.";".51.....R...o..C. j..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Version.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):256
                                                                                                                                                              Entropy (8bit):7.113543152316842
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:QW3BpiAVteSsi0cBMClY/cgsScMMUnK9Y240pD:QeAeMD3O
                                                                                                                                                              MD5:00F50DDCF63E193393A676E9A9B32B77
                                                                                                                                                              SHA1:FFE94D0502ECE202ED3B090DBAB4A3EC87272B51
                                                                                                                                                              SHA-256:8EE08B69DB1074617D9B9D93CF68562CEFA4681624DB0999845CE41F9CB172FB
                                                                                                                                                              SHA-512:71DD2A78B170800A0F99F4B72AD94D5EED287DF9840EFA1185C48B8F758D8FED272AD7C2C18FACD35850CEC6EC77192D5DCB66F17E40206C6F91B8F9EF648F3B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:H(.z..B..5"1).9..7...B.....N.".BwH...cn...r.$.t..i..xt...5..............R......T.S......w..2..r..f...k.i..2..9.....gl..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):66885
                                                                                                                                                              Entropy (8bit):7.997450473649305
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:1536:nfGB+r/JYLiBc0JeIG77MSnTxB3yWrDHAfbyFuRyHA0e8z3rU:nO+6Oc8eIPSnTxB3yQKCux0h0
                                                                                                                                                              MD5:8B7B0DD63F8DD33BEC0453A399E2281D
                                                                                                                                                              SHA1:3B20D8E28853F11B1C8B568962A4B6F9FBB1F2B7
                                                                                                                                                              SHA-256:B83DC441E9C1AC53D893471F7EAAE9E33FC4973B8EC5FEB093E947580E310212
                                                                                                                                                              SHA-512:F8C66845956326FC7CE1EBBBBD018DA9C0FABBDCF8BAA8B38C399214CC99A9DA50642A6F1C8652AAEADDF6E17BE1F68D17DFF5CB739E6C9B7CAC60B8CA7F1CAE
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:...$..}.Ie..x..z......w.7..qK.(U.Y.?..d..#....V5...s.he?.S../#Q=..[t....:5.xR=n.....<..HH...749w.U3...@.^. Z.L..(...r.W....Eu..!.bd..<....c;.P\..j.+...1.{<Wpo86.@%.k.8...C.o.m.H.j....J 3...V..@m.3k..T!....UjsZb4.g?0.&.E...EO....#m.GQ.qV.r..?4Y..e"V.....m........ V(....y..%.O.di=..8.a.Nyw.z.e...%3XM......,w..5\..e...cv.|o.."....w.r..A...J..ks..T...>{F.. ....9....&xW ....p..$..`..e.....%..(J.....a.....>...7.=.[I.{LF....g...Uj..|z....d.b8/...P.Uj.4..'a>x.....bq.B.....DfGS}*.IqQu..."5CC...c....\K...Hx..w..3...P......I....8;...$..@..@..y.....^I.s..1.a !.k(...........d.......jc*..c5RB.[W.........7.._..`.j/,8.H+]1.._a......;.&..R|.......nUU...@...t.?.D...]....B!X>...[cK.........._...P.l.&.u..L.|.0..j.jm:.Y.V..W....."J/M...e.2~S..........*!2.../..4.'z,....x.6b...}t.95.....T....$*.wm.E#X....b.,.....;.......b..{m.K..EY...ok......?^....m.....#<....T.Zh...a..6.z...n.!.P....w7*..._.+.p.^v..[9..gme.2..A....`....M.T..&...f...v..Q...ngj..5Fl....!..y..Z

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\MEIPreload\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\MediaFoundationWidevineCdm\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\MediaFoundationWidevineCdm\x64\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\OptimizationGuidePredictionModels\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\OptimizationHints\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\OriginTrials\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\PKIMetadata\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\RecoveryImproved\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Safe Browsing\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\SafetyTips\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\ShaderCache\data_0.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8422
                                                                                                                                                              Entropy (8bit):7.978769220051822
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:T/MJalbWSE9DAzn7fm6SjeQI/eefQPOgxMGlMz43LNWrp1EFzH8Hcx+:TAOWSw8znoImLFxQz4BKyu8x+
                                                                                                                                                              MD5:D174DF92A3AC86E0927580AF90608226
                                                                                                                                                              SHA1:6620656DDFBC6419D63ECA2A67FB27AB49CF4192
                                                                                                                                                              SHA-256:F4AC09E44EE3FF7A89D64C5BF9BCB8CE65CE03D5B988CBBB55FC299E108248C7
                                                                                                                                                              SHA-512:06A830D12EBF9740CCFB78A801492CD6E5CB3DD37CDFE4066DB05679DDEFE8563181FBE164C1BB55DAE011C74870D527D9B4C4A671CFABB3E0D7113FF28FAD9F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:...K..nzy^cx...<..;.]...;.....7l..-A....>..:..}-M....^..r.806\D.Ll...V..z.v....5...jv.Gp....:............W2T*.JE'l.w......N....y..!........=..H.)+.b....0..Wr...Z8...?M..og...Uli..@.._|,...V..+....(...G.... n.=.!...F`.E.=w...Q-.?p.,....T.r...m.bs......a.(,v?.|.6.(.Co...P...1..U"6.'3f.4.U%\.........6.....h.........}S..._4*..1.....(.-.2....9.....?..24.:..E...e....P.A..(..].\....V..E.. g.p_....eLg.s@...4...G.>.k..V./..Rk...Z..>.........vg.......!.Sp..X...Df$.M8..P"..z.>-.Vd..mj.b..g...72..&7.K..E..@SU.4Q...+.../_..t.....j^..L...q.....0)hx..3...z..:B...r..A.i...m..q ..........sKy....I.Y..o6..bb'..c..Eh.h...m.......W~.3;.c.j.......h....*XN....D..o.;.h.`.....`.T.yv....F.;.......'c.SyU.Y<..v...$g:<.40a.........O....p.....qb{M.q.1..5.\~.I....+...e...ZD...d.GeV~.6......1;..M..J..so.%...:BzjK".....\<..Z.~..{....G..'..L..Wr.+.H`....C.T....o...{b)....~...'....^i..g...6l'M..*.H......].S..k#M.....wpX.UP(.E.d.l.lj .zYb.Vg....4>...W...S........".l....

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):270566
                                                                                                                                                              Entropy (8bit):7.999395295160051
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:6144:x9E7Kj3u8KZ611kAan4ytkjEea5BOhBGAFyhJIU/nnPje4:xB3NIn4akjha+7wF/P64
                                                                                                                                                              MD5:5A60CB2985A0B7B0A4A7B34215A97995
                                                                                                                                                              SHA1:888E06CA251C64CF0060148A4F4B50FE60E62988
                                                                                                                                                              SHA-256:3B692684A1CA2238EA31DE3480DB08CE1E6A886CA1EBDB43A280850DD42CF2EF
                                                                                                                                                              SHA-512:81590B108F1946D8A2C9852B9CC3B8BE6B71A15591588D22A0414E67BFDCDEADDE837BB3EC4E74B8484D2E1E584E76B2A67BCDF56E268A4B8B404A1BD76CC058
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.....w3.Y.W...Wm.....?.....J3..x... ...pC.`...(.w...BQ.P.5..-.u..b.,..B.D..N.U..xU.............`...Y..N.^D...rO.Bm..4RF.....cQ...b....\7..J.....Jz+..6.1'.."Q+=....',$pUN@._.!...-..w...4.d.vH{.O%....F.:?$...f...1R......f...<.0.l}..'Vx...{B....cX\.-...xC"uJy....K....7.p$.S..a:_...u,...uC!.kt.&`le.q...4.e.........\...P...J.......w.>]...5.<.+\.`IO.....s.....S.....(qR.BQ..~..c.....K.1.....-t..x..J..mr,~#2....9....|S:k0;.....A..p...(k..x..}.....s.._J.}Q%.i...z..\a..dt..H.Y..G..1.3G<~l..V. .IiaM.hv...x".%..<..8=.3....t......Q.F..I.h#.\%y..9..1......5..w..R(..a.J...Gy.....R.,B.i...B\5'..r9IS..)0@.@.F...~.o9B.W.m..,h...H..E.z.............=..T.....n.....e-G..'....K'..n..i.ff..)...Y......&...d.q....d....:%q.....yx..;.PN.[.BI..+.H-8;2..2....>...9.L.A-.S....._.."P....l^.URU......Oi.a....]..k....T4W....:..P.Q5.I.Q......\k.R.r.....mK......c>.4.LQ....z........S.......:....=.$...H...R.!....G...US..U..R..........i.U..K....=....r........F.~..~.\#.=.:.^..

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\ShaderCache\data_2.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8422
                                                                                                                                                              Entropy (8bit):7.975272503165305
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:uvP5IryvkmC8LoMLZGAUgCdZ5666g2vsNyyZMtmEDhLwunI+:unaOYMVGACdZ5666slZkDhLfnI+
                                                                                                                                                              MD5:5996B6EDBF4E5715BEC9D9873F55764A
                                                                                                                                                              SHA1:629E77BFE41C34E80917F3DD985E38592F08AF43
                                                                                                                                                              SHA-256:519FD90930DA014B03E5C0812906A189C39E1112A34BB9CB3799F6537E38AE33
                                                                                                                                                              SHA-512:00F3671F01AE30A4D65AAC9D72232F393AABC0F67F0B5D7D01083E782CB72E86BA74E885A1FA61E2AF51B4A8D4B9D6653960B5616B5BBA4BCCE250B62B74D9BC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..H?..ZG..O..^.*....]B.1.....y5R..-&...f.l.:#u..d..M.............`.a.O.6.......[....q.!y........*B.j.......xV..Y%........H.b...b..4..|..kG._$lo.>..D..).W.^....C.f..D..yz....%...\.p..c.....Cx?.9..W<.......i....(.7...$......@..%..N.'.....G...3...tq.AJ..cHt.T.b.=..9&..g...b....]...e....ssS.I.S.h...h...a.p.......].......MJD/v....w.Z...@..$.Gj......f<G....vU.6....Qn4?..hm....^...X{.....)%&.l...*.F.!Z.0m..V.+..V.UrW....`..;.~.h...k.R.@.#..?2.#..u....rH..R.7....J...........r@.T@B...7....D..Z.R....H16.[.$fR...Ei,..9q...Z...h...8}=.....`N..}..H.:.!.w+..F..g...v.2.W.E...[n..>...wt......;.|>...x...r.6I."a.CY.....wdH.......L.HX...k....:Y...U.|..N....]1..........N.N.C6...b...L}..=.9..~2.!...?=...._0.*...".Q'}...;.g!..V....8.l.8...n..C..`..:.T....<..a..sS...WU...b."b.kL..<.2.J:....c..z+.k..,fE .T..:F%..<..P..i&.HuH...Xu.A....yJx.uo.M@v.....p......hiO..H^....>t....IS.*..z........:].`z..H..n_.#..w.....n{.......~4A!B2........... .iC......u.,.#...+.=.....s.

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\ShaderCache\data_3.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8422
                                                                                                                                                              Entropy (8bit):7.978076639483952
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:6nqqA0qi1S5OHsyCqR2nvVJmFAt6w58jDXSETMxCJbo+:6qq/zl9Cz9IFM6wcGErs+
                                                                                                                                                              MD5:9259CC689B7C0CA287E06EA408E62D27
                                                                                                                                                              SHA1:6EC516B03F72F4640A6EF0C1E555BEE3C467FF4B
                                                                                                                                                              SHA-256:66C5209143ADD02AB96ABCD9967501003C9A11F3AAA1B0A4F4C62DF03A38C47C
                                                                                                                                                              SHA-512:2425DC49D180C98E240A5ED6C1BC2FEB04D9D4CBED9F169F2D21E71C389243623D5BE154B2B811C6C3D069F7762D715D23F7C0086CCB1D31449F7BAA06396D4D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:...."..(\^..lr...t.3....T.".(.KI.7.....I..........:... .M.4}ge.N...d:Y@;.R|...h..3. ..".9..$....{"^...`FH....b^.f...p...Hp7...[.P"........M.w...y....K.=._...].....u'`..rx....cf.f{WH..QI...z.CvP.?..c.Z..g............\'.......:.....;....p..,.&..ob*M...,@=S..e".f..O..l.....8./v.%q..M.....C.l......y........fn..)..1.8e<..,.%.H.H...xc.p.E.Sm.k5.Zp/........R...Y1.@...R.'...z.../.PeK..y..H.F..01...bS....}.k...$...n/z..h.+(...&q...\1~Z.d=..Xr...g.x..G.P..1..q.;...z.9K+'M..j.......Sb...A.. P. .|.l]....m.%".q... ............B!.a.}\u../...c.:.K.....)fTn....,...u(=........E...7.-6...8....k./.....(.)2p.m..~x3....W........Rk.....e.......$...9@>P..:T':p+...0.tl....UF..vZ..3@.\(b.b.....8)./.".8.. ..'..?...]4.......l.M.5.G..<N...E.3R.|.cV.p...h..=...*.Hg.h...w.:2.!glYG...T......5*.....2.(.r1....x^qEn.yqN}.}.TW...l.m...Td..t...>...A|"..f`..*.n2..)...p...bp.q.w.....K.o.?.S...B...k.60..Q...K...tVT.".(J.Kw...}.T.j..._T.rO`.%........'..1.H9I.@..9.*GL..(k.z...\LBx

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\ShaderCache\index.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):262741
                                                                                                                                                              Entropy (8bit):7.999235610456981
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:6144:Qks0vWP+U4L7fODgtKSjM9sxYwejy2n1VbUXPfy7E:Q2U4L7WDPHwh2nX4XPfy4
                                                                                                                                                              MD5:4D81E68B47F7238F5D1D348C571FF034
                                                                                                                                                              SHA1:267E4182B9038D8E6A0BD5B464169A7F2DA25DD6
                                                                                                                                                              SHA-256:82A28B5E9F8F08B5130D20234241393B970913EBD7C127838DD54CDB1D3DD0D2
                                                                                                                                                              SHA-512:48A71A84BCAF296C8DE2362888547B00773B990CB037CCF9F00C0CA1E57C9B24E43FDCAF7C87ED69646C020190797F600945CF5DC396E57C6187BEE55F4360EB
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..)[...8.m._....q.Cyd/.\.8..msjF....'......b.......j....{.B..<>....j?..IP1`f..N.}..i2..>..........?...0..|F.C..........M.")...?%.^E...E..l6..H....j.|.S......Y...gNj.b......ia-gs......&.v.SEZ....#.*.d'..F.......)..G.B..y.0D1..$5B.v.,...'.s.:.&..'.d..m.....2,...-..Mh..*.hL....]..G.cs$-.._.#^.2a...U.5.%...F(`S.....nDa=....3..UM........l.XN...#.....?.!i$.V..r....udz.qv.D..m....E.V....H.b.j(.....E]........,B,.8IR.$.D....W.*.@..ac...X.JY.3W.n..y..k..B...#..%j.a@T;=.......tjV.k..Y....x.;.V=..3...E..^.. .<...a0../.@b..;./....5@....1J...KS...g.)...s.&.@..I#3QeQp......e...q..5y.I..|..z"....6.|.E-...A./8.T.?.ab.&es.]9. ..\......x..[[.j....A...8I...C..Y.$.e1..]...7....e.x..t.y......mc..5..(.Vb.%..1 ...k...<.[V......R.....f.|.Z.T........H.z.3..B....T...X. 2.[.:.<..$.r........1.[c._.E.d..k.Y.....1.........14......u_..F(S.V!.........c&i1.?.i.z=...Ky....E....P..E$[.~.......w.;."....}..H..b.......p...>...P.!...,.{.ca.~......x....d..y...(........,UU

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\ShaderCache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Subresource Filter\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Variations.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):320
                                                                                                                                                              Entropy (8bit):7.349625438448053
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:QNLCd0LWvCZqLUOYbHGMYI/XCdV06mKcgsScMMUnK9Y240pD:dP63n9l/ydKlc3O
                                                                                                                                                              MD5:5AA09867ABECCC606D7D6E90D55D9616
                                                                                                                                                              SHA1:5913E6EE680653E4D56457F6DF9E3CC68D91A4A3
                                                                                                                                                              SHA-256:D12F387524460CAD0B2050163B6B6B5B4360FDFE23FEA05570327B6ED0A28986
                                                                                                                                                              SHA-512:E4070B666A431907C435AAF98689C99734564CDF3AF43B60F8C859C1FF67AA566B38C2F5C19682BC2725C75D7B776EE78DCFB5A7477574557F108C0BFB7C0AB9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.[..(..Z o...a..{.n..`%.3.....LQ).E./}...t.)......Pc...+..{N.W..Z...A......5.9..6..o..d...I.>y&...ct... .$.t.[...MN.......1.Ir6.Jz...T.Be.%.....#4..R.Q.".....A.......]..e..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\WidevineCdm\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\ZxcvbnData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):49403
                                                                                                                                                              Entropy (8bit):7.996093991716737
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:uf9COvxd6Fi/Nf2fdBvNtNALPM6Mdf8AVJAou8wsC+Mt/B6kIkx003qAMNfol5MK:uf9Rm+NfwfvN4Iv0zJ+Mt/Fbe03Fx
                                                                                                                                                              MD5:74DA185D6D5559BB40C7C9DBFB670CE1
                                                                                                                                                              SHA1:8BA6B4EF21EBEBEB0CC221AC7A0D5F71EFD6664D
                                                                                                                                                              SHA-256:A8D745326FA997F437087319660CC6E6EDB3488C63F1AA786BE2360A34A6C9B8
                                                                                                                                                              SHA-512:67BEC27C052E82BAF4A410130F58E23EC9504F22442045D61F10759430D54D72EE651299A705B3A0A5863DF76EA19E282C230F289D5E2D07293D9C830CCD22CF
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.6..%.e#.7...g.|...H..p..D.q|.+....A...D'F.....S.F3....z."..n}....d...M.$<.ZT.J$@F.:B.J$...%;G"E....?.J....Y....]...g.9PE.?..y.P...2..c...>B....y..:.....v-.#O.mp.....(.K.>...X.`.u.V!..@l...5>S..i..@.D.6..PsOT..c.S.......g.GT..t.k...../.+.G6..M.`0.@.^<zI....5?....]..B...rh.$6....?. .........s.MJ......R..>.RU.}....7......U...c..yqT....TF..c.......7.%e6-..,...R.P.).Ri@b..A._...<.Y..,.B..J..]..P.i.{..h....../.r...m....5a.yT...%[....s>8.|mvqh......5.O..\..*....} .|/w.v...."#....P...B.Rh.....U.L.<.j....s.F3.gZ...>l...i>........4.z!z.._..wN..D\l..|].........;..0]...|..)...+Xd.%".t.....j......=.!>.^G{.dn.....x.ZOL..s..Jd.Uh.L.......:6h..*.......t...8....e..^a3..>.."..h...h.MP0..._....Rq.!b.=m...........G,..-.:fI_...{...R.....Xw../.d...b...9.}>&.7U.V.P..C....G...5...JA.........C..R..{=X.Ey.k..:.....R.....lc.O.*M..6.Q...Wt........6.H....h+bWYA..%..g............n...}..8.'{....4..^.....Z.V..U.'.....R...y..........M.1h).@.LJ0i.F._.T..@.=|.....

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\hyphen-data\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\pnacl\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Google\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\80E5AD7B-B7F0-4875-BF29-ED264BCAFC67

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):166208
                                                                                                                                                              Entropy (8bit):5.340926777317099
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:S+C7FPgOsB3U9guwwJQ9DQA+zqzhQik4F77nXmvYd8XRTEwreOR6Y:vIQ9DQA+zqzMXeMT
                                                                                                                                                              MD5:7CAE8EED86B6E10D94DE810168EC7B93
                                                                                                                                                              SHA1:A45E10B8FA0E797D6C8231278439AF491835F066
                                                                                                                                                              SHA-256:3E14ABE9A26B545CF1FA0A34BC37A1969E651AE293A83CF7056D5C2E9036439D
                                                                                                                                                              SHA-512:B563E4A5B5E767E48BFAF11B0C6F86788429969D9DDC1AD23CB274B5180F575672BE71B0FA4A66EBD36D9A8EE7D3E3731BA48E8E65CFD024FB15AC392C00D0FD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-04-26T07:16:42">.. Build: 16.0.17619.40127-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&amp;p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[MAX.ResourceId]" o:authorityUrl="[ADALAuth

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Office\OTele\onenote.exe.db

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3023002, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):0.09216609452072291
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:lSWFN3l/klslpF/4llfll:l9F8E0/
                                                                                                                                                              MD5:F138A66469C10D5761C6CBB36F2163C3
                                                                                                                                                              SHA1:EEA136206474280549586923B7A4A3C6D5DB1E25
                                                                                                                                                              SHA-256:C712D6C7A60F170A0C6C5EC768D962C58B1F59A2D417E98C7C528A037C427AB6
                                                                                                                                                              SHA-512:9D25F943B6137DD2981EE75D57BAF3A9E0EE27EEA2DF19591D580F02EC8520D837B8E419A8B1EB7197614A3C6D8793C56EBC848C38295ADA23C31273DAA302D9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:SQLite format 3......@ .......................................................................... .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Office\OTele\onenote.exe.db-journal

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:SQLite Rollback Journal
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4616
                                                                                                                                                              Entropy (8bit):0.13760166725504608
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:7FEG2l+nall/FllkpMRgSWbNFl/sl+ltlslVlllfllP:7+/lagg9bNFlEs1EP/f
                                                                                                                                                              MD5:3652077B2BB52F73937361FEC379BF8A
                                                                                                                                                              SHA1:3BD56DC7F00BE133091E1407EF794F7AE9AE2C86
                                                                                                                                                              SHA-256:78685498E025788F5F102BCEC8FD4965CE2478D394D1FEC941DF2ECA5052BA41
                                                                                                                                                              SHA-512:8D95DF59ADE3CCCEB4F7DB769B6C5C322698181A8312EE393B9B91C59D95B01030E8C69672BE6D26598B4DC62C54F79FAADB780FC16D8394BF068423779132E4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.... .c.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ .......................................................................... .................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Office\OTele\onenote.exe.db-shm

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):32768
                                                                                                                                                              Entropy (8bit):0.04482848510499482
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:G4l2JRZ57ZCl2JRZ57uqL9XXPH4l942U:l2JRv02JRvL5A0
                                                                                                                                                              MD5:93A52E21C1CDFBBD843BC60B6D3ED8B7
                                                                                                                                                              SHA1:0C3C30D782770F87430F9EC5FE3ED60BF38F3518
                                                                                                                                                              SHA-256:893FCDA0DF42A4B2966800E3550ADF389FB622A6922281EE087B5DA02EB821FE
                                                                                                                                                              SHA-512:E0F2C91AE4DAC3CF9AE68FAB622C6D5425546038E35C7EEB2CE327FD5260A96A407D7A068177E070BCBC6D5651861ED90C6D1C166706C85C83BC3AB810FFFA19
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..-.......................#|C~.O....../.2..E..-.......................#|C~.O....../.2..E........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Office\OTele\onenote.exe.db-wal

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:SQLite Write-Ahead Log, version 3007000
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45352
                                                                                                                                                              Entropy (8bit):0.39502661498825237
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:K43jSQ3zRDiX0HsUll7DBtDi4kZERDQrCy28zqt8VtbDBtDi4kZERD:Z2Q1W3Ull7DYMYw8zO8VFDYM
                                                                                                                                                              MD5:7E5CD8FE9B3B01551752A3A3731A5AF8
                                                                                                                                                              SHA1:9074FEF501CC3B8D0BBFD362E03EF5A3931FF6BE
                                                                                                                                                              SHA-256:C55BCDF440CE7A48DF46610B6F9F8687E6154A9F8428C3240DE15F43D08B76DA
                                                                                                                                                              SHA-512:3644C14FB71EF86230494A8039742E10F0151A1C5CC8210FFE0565641FD131E33FC5BC049D403FE5FEECE30BFFC4F53151150528D8164F3C4E823672875D4B77
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:7....-..........O........b.n..........O.....%. @.=|.SQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000000.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):49152
                                                                                                                                                              Entropy (8bit):4.916171781460743
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:g4Z7haDGl83om+RiL4Thh5Dor6qxLFb1c4LIhc/yetint16APewBqm8loQy/NHrq:g4Z7haDGl83om+sL4ThXDor6qxLFb1cS
                                                                                                                                                              MD5:E52DB53598F8BE1D85A904FAFFAE3CEE
                                                                                                                                                              SHA1:E50FF4A92D5F45C7B5D8A459BA4DAFBC5EA98287
                                                                                                                                                              SHA-256:E6B3CB26D88493A32F247BBFAD429BB35DF38D5E39840E5F614AB8927BE75254
                                                                                                                                                              SHA-512:B3F9FF93AAC8C0E3AADE2129E66D6D624314816B7DAE74E5F82AE8C9C8F23B64D7885202FAC8B81285AACEB22AB0AE54DF2C44361EF6CDC31BD9D22A0737E47C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:h.......X.......0...p..............................@...@...@le......9.z...m...........H...H.=..*....N*L......................?.............................................................................................................................................................................................?....................h....1..8_..8n..0...p......................?.......................................................................................?.........................................................?.............................................................................................9>.8.........\*r.2.%.1...M.9.....X.....0.i...3-e..X>.....8...................................@..........@[....w.....D\.............H...H.=..*................H..@[....w.....D\.............H...H.=..*.....................................................................~...........................................................................?......................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000001.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):0.04401584019170665
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:RRk//:Lk
                                                                                                                                                              MD5:CD74ABACE8A00B17BD8107BC5982C21E
                                                                                                                                                              SHA1:D53193CF8A43D766FBFA52976192F44D6B0F79B2
                                                                                                                                                              SHA-256:B670BC07C9CB554511180DCF3F6A2C7818E8CE6E67B84784F0EA4D35EC61D516
                                                                                                                                                              SHA-512:1B48A37FCF0F9FB9ED9B31A8F3E36596689BF1EEC6F41F5EFA3C728121944919CE7A81F0379A108D80AA051CFEF07DC296F9C0691FC8855983B2F29EC15C7FEF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000002.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):0.49774734046982405
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:vldawlAuil8xt/l2lkt+K9qX/gU/t2kdcXltEo+Xl2hliJw5YUQWTk/lL5bOzWlF:NTcktv9OS1t+1GwJGTAI5w1EVzJIZ
                                                                                                                                                              MD5:5998E0B14383A6F22EAF1214C33F0039
                                                                                                                                                              SHA1:35F4B14BDB0AEEAA33FCD07CB5EADEF88B1E8F74
                                                                                                                                                              SHA-256:2FBE6DB7786E26D5B0931CE96B2345B839B304CE9E36FD463F7D6B8AA6BF7D0F
                                                                                                                                                              SHA-512:5E11B81505C38E883B84D983140A57E95123D22EF18790E790E8A08BE355A44F5D4B23458F40B6D005711E19126100D992AA5613B8C42DD8EEA1509CB2782C8E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>...........~....................................................................................................................................................................................................J..>o..................................J..>o.....................................................................................................................P..............................................................................5........m;.H....7.5N........ u&............m/u.9.F.lk...a!....N...^............................................................................................................m/u.9.F.lk...a!............................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000003.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.766314594572106
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:eHtnTzWxz3LPExyw0LQBlkw0L0qECL8E2fwEwL4l6DYy:2GxjzExyLUgLQqECgE2oEwcQDY
                                                                                                                                                              MD5:DAB72679A54A57908535A775EBE8C75D
                                                                                                                                                              SHA1:F10967EB4026C9335BFA013ADD93AE68B9D11CA5
                                                                                                                                                              SHA-256:87B996AE6E3C04C205917B75442B8F4C60429EC09107FC7A629B249B93688BBB
                                                                                                                                                              SHA-512:C55B8D34B9EA3B7A10711487D0F49C28352FFCD5FB38CB47BB780BA1773850453F062954CA66B34B4F1BA58D6067F8237291E98796BDA76AE9519FDFC9F7B13C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:j.......`.......L..................................................................?....................................................................j...............L...........................................[.#H...G.....H.......H....."*r.....C.|...',J7...C..le......9.z...m.le....H....."*r...(..H.....................................................................].r.....].r...6D...D..X4.E.......E....lK.>......2.......^.............................H.].r.........C..............T&....[.T$...].rT%m..#.~T.N...............".......h...E.T.:.......E........H..c..,0...e...B4.$..........C@RQ.H..B......Y....................#.~.....#.~^.}F.3....v............mo..-^.U.KH....[.....X^.&.6....[.....D......LV.[..#.~^.}F.3....v#.~.....>...............le......9.z...m..[.....D......LV#.~^.}F.3.................'.nm*.y...........[.....X^.&.6.....].r.....le...c..,0...e...B4.$...........I...M.....0...............................0...........e....4..................T.i.t.l.e.......|{

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000004.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):4.71115429105396
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:/s7uv4xkB+5Z8PXWACRi+F4aXxc1gLVi9H8P04k:0J6M5Kf7CRiwq0VqcP0
                                                                                                                                                              MD5:F5CD1A6629EE1087766DA6331C1BBEB7
                                                                                                                                                              SHA1:B59A893CCF74946D2BB0BC1DD1B25930D1EA356D
                                                                                                                                                              SHA-256:8DA0C0F170BB6F831CD80AD5751C4DF53B7684BF7A15DADD15F552807B413DB1
                                                                                                                                                              SHA-512:52DD0BFD69BED1688715FC1414A99C561BCB9ADB317ED6725B71EB19ACED4045C66A1B92506A4E2A6FB3FFCF121FF34E83AFD0C94F606458FF2329E127B533F3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......t...v...h...................................................................................................................................2...>...P.......v................................I.......I.qk..B.....LZA.%.4...A.%.]......k.V<.A.%.]......k.V<.A.%..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................U.x..'.;6k3pu....N...^................9..-tI..!.6...............>...............................$....I.qk..B.....LZ...............U.x..'.;6k3pu...........U.x..'.;6k3pu.........A.%.....A.%.....A.%.........................................A.%j....A.%T%;..A.%.....A.%..W..A.%H....A.%..+..A.%..S..A.%..........Z4...........................................4../4......p...............C.a.l.i.b.r.i..................A.%:A.%kA.%..z...y.. x.. ...........$...........7...7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.3

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000005.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):40884
                                                                                                                                                              Entropy (8bit):7.545929039957292
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:MCBOA4d+ElOXJ/3pI7cRBiL7L6qERqGz65WXzZqJsKQSbIsTT6XB:hIAU+2cGdLX6qBG4WDZl4Ihx
                                                                                                                                                              MD5:7379775A1E2AB7FAB95CFFCE01AE05F3
                                                                                                                                                              SHA1:3D3DDFD8AC7E07203561BAE423D66F0806833AB3
                                                                                                                                                              SHA-256:9301DB6D2D87282FCEE450189AEACE16D85F64273BF62713A3044992B6B7A9E9
                                                                                                                                                              SHA-512:4B5006E620E80D3A146944649CF4CA619782CAD7E8C4CD0D1DE0EBCA0FA05EACB7378DAFCEED3E26F5698B07F19604614D906C8F51F898660E2F129D8DEC6F62
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1A.....Qaq....".....2....BR#S..br...3T...C$.7(Hx....4D.G..Xh.cs..'..t...%...8.....................1...!AQ..a...q"2.4Tt.......R3S....Br...#s...Uu.bc.de..$D..6..C%E..............?...z...;sB.yv...........]t.\...n...../....m....M.=.3G+..x+.....S).*&.J../..8..O/+..sG...p...<!....~.c..C.w..,[oHom.wc-.J.~.......L[..6...'..i_..S;...!Y.z.q].EK..M.x...i.x.+.;.+...}....#......f.)........e6V..p.;........s.)..Ml.J......IU.6...<9+9.^..l..Y...[._...2..^..j.ia...._..3.;...~..<3...;......z.^.......]..Qk.,...Yk...3.3Jy^p.}....q...I...&..t.......;..9.g.GH;..'...%...)..[..y..../...zCn..>...'...1e.Y..;....]..7...N>t..m-.j.............H^..T\.q.ru...}...eTn]I'r.^].#..wOY....v

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000006.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12288
                                                                                                                                                              Entropy (8bit):4.427717426684559
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:bsOniKlVRJNTGAcEsRKqzB8LuE0lg184BVdop86Rpj9SoRKfgXKiKRkb7JMuZoNr:AkZlNdFFsRKyB4uEy4nBVdopfpj9SoUp
                                                                                                                                                              MD5:46AD159A57FA9E749681ACA489F5C73C
                                                                                                                                                              SHA1:A40EFAE70951B8D5D6FD8226C10BF2CEA13FA510
                                                                                                                                                              SHA-256:633ECDA7BB3F2BB2126658427D307655DB8ACC32599A0D2C43808360844115DE
                                                                                                                                                              SHA-512:D674F4EEB37773CB7C4CCB138E835DDA2B89803203C6464DFAE68A043163CCBEE5ECB030708EB901970B8BA91CF4DA2D144149C3BE4AD0FB59E59D0242021C33
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>...........v........ ...)..2...>...B.......v.......@....(...........................................................................................................................................I.......I.qk..B.....LZ....H........-..9.yl.S.......-..9.yl.S.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............Yl..G....V...;.....N...^................n.J.g.G.....g.=............................................"....I.qk..B.....LZ............Yl..G....V...;.................................................................................................j.".....T.................T............. .A............. ...........3...:...8.....z...y.. x.. ........ ..$...$........D..........7...7.........*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.1.5........................Z4...........................................4../4......p.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000007.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:19:29], progressive, precision 8, 221x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):24268
                                                                                                                                                              Entropy (8bit):6.946124661664625
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:d2wiieoHTRh5a1HAteZCWOZIM+L7WhNjYn:8wHFHJ+/OZIKhNO
                                                                                                                                                              MD5:3CD906D179F59DDFA112510C7E996351
                                                                                                                                                              SHA1:48CDB3685606EDD79D5BCDF0D7267B8B1CCBD5A8
                                                                                                                                                              SHA-256:1591FD26E7FFF5BE97431D0ED3D0ADE5CFC5FA74E3D7EC282FD242160CE68C1F
                                                                                                                                                              SHA-512:2048CBA13AF532FF2BCC7B8B40541993234BD1A8AB6DE47B889AF3F3E4571F9C5A22996D0B1C16DD6603233F6066A1A2A97C16A6020BEDD0826B83BAD0075512
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:19:29.....................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................$.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....)......[]t.\Z..g......A....&D.$LH._..X..Xl...`....cZ.X.........>......f.Z.X...]..~L.S..@..I$..I.IO.....x...s.g.[f.h{9..

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000008.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12288
                                                                                                                                                              Entropy (8bit):4.662862614366846
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:rsNPNEIXgiI0AY3uaGNhj/GUQEor/zKz+r5yXXLF5Rpq+SqRZxyXMQl9LYr9kVns:QMugiI0Kp3juUYTzr9MXLF5Rp5xMMQH0
                                                                                                                                                              MD5:586C31995EDF509DA134F7AA531E40D0
                                                                                                                                                              SHA1:2C3446BFDEB698ECE34411FCF619021BC0D2CBD4
                                                                                                                                                              SHA-256:E055CE5872B4CDB9E451B7560B859DCB17F4B86D3A2EA7222816804954FE8B41
                                                                                                                                                              SHA-512:1704A1FFC27D9B42A449C48DC07A76B300467A33539D8F7844ED6420FDD060E5D8E1AB62E321C7EFDA27AC593FB26CF8F7CBD646D25FC66BF5A9A9CCE3FD7426
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>...6...z...v...N.... ..X,..2...>...........v.......@...H+...........................................................................................................................................I.......I.qk..B.....LZ...N......!...'...v.e...!...'...v.e....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............w...S.....i^i......N...^.................R.%..K.Dq..lyJ............P....................................I.qk..B.....LZ............w...S.....i^i..............................................................................................j.9....T..............s....H........0......`.&............3..:..A..8....z...y.. x.. ........ ..$...$...............7...7.........*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.1.1................Z4...........................................4../4......p.........

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000009.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):39010
                                                                                                                                                              Entropy (8bit):7.362726513389497
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:6tCjwO+E+KW0ZtOgepcoWW4pAWQ6/KWcR474HOAZaDfK:68j+E+KW0HOgep/72/NKWcRNefK
                                                                                                                                                              MD5:9700DE02720CDB5A45EDE51F1A4647EC
                                                                                                                                                              SHA1:CF72A73E1181719B1CC45C2FE0A6B619081E115E
                                                                                                                                                              SHA-256:7E6A7714A69688D9FFDF16AA942B66064A0C77FCD9B3E469F89730B4B9290C3E
                                                                                                                                                              SHA-512:5438921467D62376472007B9EBF3C35C9D9FE3EDE04D99A990129332D53EBC8EE2555C0319A4F7C0DF63516F29CEDF2171D8B6DC34C9FCD075C2CA41EB728660
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!1..A...Qaq..".......2BR#...b%&6..'w.r.3f7W8.s5EUeF.g....CS$4.Vv..Tdt..G..(c..u.Hhx.......................!1.AQa..2.q....".s...3.4BRr.#......b.$c............?........uf.....t...;..[...W.h.....-.k.f..i.u..KQ..b.F...rM%/.8n.S..=9.....G$O;.f.}L..N..U._i.[.X...3.~....S.~..+t$...c.5......{..X/..#.G...}s....6......^....o~.$.\WA?...^*w[O.~..6..~....a....~..:..0.......{O...|.s.u._w.........i...........{K...._.?.../{.....A..8....<g.iu..<..................X......|]v....D..9.k.w.|-IF.Tv.-.&.........."'.4.b....z.._.Z.....G...u.xyt./_.q..m>..S.V.Xdc.bw.T.W......g..........}s.._..?....U]_.......`......>.|'.~xH....,...?........?.q....o../..R..;...Y.G....A"?......?.<..1...w..o.M.........tco.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000A.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12288
                                                                                                                                                              Entropy (8bit):3.894905308868054
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:XGsHhqvc9DmEE+0Ip0AReSgd+ifHrUmB83whckSYYU1fk+cXc1l1:XjHhrD7Xr+ARe31UmBWwhcdYnByC1
                                                                                                                                                              MD5:3C0F0F2A64541EB15ED2E2C6A95F4D1A
                                                                                                                                                              SHA1:1539AA0D79DA3FC6CE0D546DB296B288642E7EA5
                                                                                                                                                              SHA-256:6B96E207F520499C48891B12C259AB8CA70182BF7E67827E861931E12B82AC09
                                                                                                                                                              SHA-512:3D3CBA3FB8A5C821096D7E235B85D7FF6272400AE7C940FF6AE7AC6279199FDB8A4D076BED923F9C7AE6AAF769980FBFE3E3CE6868B4F8B1859B5006E9155C00
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....>......."...v.......8 ..."......>.......r...v...>...@....!...........................................................................................................................................I.......I.qk..B.....LZ.j.......j.%2?......T.J.7.m3.k..2.L..w.?7.m..j.%2?......T.J(.j...I.qk..B.....LZ.I............I.......I...................................................I.t.....I................................................................4..'...'...............Yv........z(._....N...^...............9N.HY..E....^..,............(...............................z....I.qk..B.....LZ..............Yv........z(._..................................j.......j.......j.........................................7.m.8...7.m3.k..2.L..w.?.j.......j.%2?......T.J(2................................I...............................7.mH....7.m.....7.m..d..7.m.....7.m ....7.m$.7..7.m.....7.m ........7.m!7.m..z...,4. ............................"......$...7...............T.u.e.s.d.a.y.,. .J.u.l.y. .2.8.,.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000B.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):59707
                                                                                                                                                              Entropy (8bit):7.858445368171059
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:k76rvGc8WKC2/UX1uEgVRY/jvv9CblyL/T:k77Z5C2/Ow1e9CblCT
                                                                                                                                                              MD5:47ADB0DF6FDA756920225A099B722322
                                                                                                                                                              SHA1:851946B8C2BD0BB351BAEECA9E5BB6648A87D7CA
                                                                                                                                                              SHA-256:EC8CD7250F3D82E900E99114869777EE859EC73EFFABED108815F65742078C3A
                                                                                                                                                              SHA-512:85A9920E1CE4A2FCCEBAFA425C925DF33580FA3C3C00178F058539B2FBC0163866DB8A41B320E2EF2CD217F00FFA06A1A831C728D3F9F910C9EAC58B5DA76E2D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..A..Qaq"....2........B#..R.b3$..8xrC4&'W.%e.(.c.d.5E6Ff..h..SsTt..u...Gg..H.....................!.1..AQ.aq.".......2..st.BR..56.r#3.b.S.4c%...$d.CT............?....3.7...G:../P....z..K.:6..w......6....... .z7...~.....{gdF60...9....{...'[N....m.........z...g{.......7...4..1..=.z...._..p...m..Icd.~.v..9.P..0Z(.<j.......R6zm.....v.z...>x..)=g........zo{..w..f..y.t.....%.D..#.}.I.>).H.QM..cLD..x.../.^y.{.............y.=^.......I.T.......U..0_?...u..og..3.ky..K....6w...Dc......~........ik.z....N...en......_.....x....._u...4.{..P...>.....}.......>.R.....m.....[mt.....}.........|.....m......~....B.F.]C.36..q....yg...{]...+.DZv.9<.o..;..N.n&im.,....w.3...V.s...Y..e#$.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000C.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12288
                                                                                                                                                              Entropy (8bit):3.8769451002854733
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:oC6seWs5bLuzyucVqXJrRlmehpCs3Ay9l0O0TQ:oC3e/umucVkJrRlxCx6l3
                                                                                                                                                              MD5:3FF8B62E78EB34E71AB8D793981144C9
                                                                                                                                                              SHA1:F9565E115BABF35402E9B5B20C1F7CA640E59666
                                                                                                                                                              SHA-256:4393A22B5914EB81A8A0342D6951E60E8A5DE081B3D460520614F7191CC8BB79
                                                                                                                                                              SHA-512:38C2057225AFCEA897A1F6F22BF8350F35D5DEB4DF99219AE70B09ED9E47F0EFFC437817119EB99DCED9855A77E84321F414FCAA9A6EF6858FCC46862C08C258
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>...........v........ .. "..2...>...d...<...v.......@....!...........................................................................................................................................I.......I.qk..B.....LZ...<.........m$...4.......m$...4.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............J.K.h..7..)........N...^....................E.G.Pf................................................D....I.qk..B.....LZ.............J.K.h..7..)................................................................................................j......T.T............|......;......h........... .W.....'..2....z...,4. ...."......$>........4..p..7......S.u.m.m.a.r.y..........................3..8....z...y.. x.. ...........$...........7...7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.9...............

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000D.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:18:09], progressive, precision 8, 164x641, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):27862
                                                                                                                                                              Entropy (8bit):7.238903610770013
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:LTawAZvhbrXzDc6LERLQ/b5vXOl6pXQ/wD5OUMrdRUUhCplQg0ESSz:6wm/vT/b4wxoqbdUhWnSs
                                                                                                                                                              MD5:E62F2908FA5F7189ED8EEBD413928DEE
                                                                                                                                                              SHA1:CA249B4A70924B73BDA52972E9C735AEC35A0C5D
                                                                                                                                                              SHA-256:20ABE389C885E42B6EBE9E902976229BB6FD63C8C34CB61AA70B8B746209F90A
                                                                                                                                                              SHA-512:EE8D1821A918BE8714F431895E7223D08036E88A4FDB9A5485EFF246640EE969A69A8AA4E2E9DDC35BA75FB6D4E95092A286E90B477BD6998C313639C2C31F25
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:18:09......................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................!.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..P.v..+..n(a..Q..S\6....Y....D......} w#.b..]l.5.RU..k...... ]$.$.........f........?.z@2uU...7....?..|.Q..I.&.. ......"T4)wdH.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000E.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):20480
                                                                                                                                                              Entropy (8bit):5.309490987608
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:mhKWTa9bTU4oO5l0XxTUPmZX524yVAOqqY8ZcKQ8wDS+dy0ly4DGg4Xg:mAVpb5QpjRYsQl
                                                                                                                                                              MD5:2402B4C574E4F265BBA4A11780A30FBE
                                                                                                                                                              SHA1:25F0DD32498DA90DEBF9A008CFA38D62780C887E
                                                                                                                                                              SHA-256:1E4CC8667E8B7642F137A6760925FF629A5BA14B915A69EB850C53F9D13F89AB
                                                                                                                                                              SHA-512:9173E2691947F6462A8319C8B99C2D2D76517F6AE1AD8D9684AAE4947C44E5B1BC480BB3A2F338787D022EE2EEA5629495447D68747B5CF2CB26229FC319A519
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:...@....0...........H...(@... ..@L.........@................d....J... ...K.................................................................................@.....................J... ..`K..............>.......>...on...Y..?..A.,.......,.T+...0A.... ...v5.:6.....m.....v....c...=.....I....e...s...2.l{.Pcie.............).......).....................................................T!......T&2..a@.T"6...K.T.N..T..T%M..oy+T&H..j.9T#}..%.CT!d...........0...........e....4.........................A..:4E.2..p1......(...`.i.....(...(...B.a.c.k.g.r.o.u.n.d. .-. .Y.e.l.l.o.w...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.r...P.a.g.e.V.e.r.C.o.m.m.e.n.t...P.a.g.e.O.v.e.r.i.d.e...P.a.g.e.N.a.m.e...2...0.0.0.1.9...1.....0...U.n.t.i.t.l.e.d. .p.a.g.e...^.......^..7.....7..P..O...............H.mf.....2...L.......x...................>....,...m..ML.......K....0...............0...........e....4........................yf.....F.Q.........(...pO;.....(.......S.t.a.t.e.m.e.n.t...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.r...P.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000F.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.120152148925155
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:Yxs5669IwQlLMPgEauqXm9CjbTgRLlMD9Iv5792:IsTfQlA9auqXm9CnERLlA
                                                                                                                                                              MD5:51758B35522264F111B4519364CD3C5E
                                                                                                                                                              SHA1:F0D718001DFAEC2090833C6AED77687F126D1842
                                                                                                                                                              SHA-256:8017031B4261931A744B246AF9146DD955CBCF9A7564C6A736380A9AF0426A39
                                                                                                                                                              SHA-512:09C02E3F260DA022E0B7B00E8BB43A8B4F2715C468D3E7AE3B71955BC51EE09ED5E228287D626B8F1074897CF9F772F0DBB3CED252454E286A1A6F2E0E05089C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>....... ...v....................................................?....?.............................................................................2...>.......|...v...H............................I.......I.qk..B.....LZ.[D......[Dg..<.).%ak.&..[Dg..<.).%ak.&..[D..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................1..#.....}.....N...^...............N..hx5gB....=..n........f........................................I.qk..B.....LZ...............1..#.....}............1..#.....}...........[D......[D......[D..........................................[Dj.....[DT.]...[D......[D..B...[DH.....[D..B...[D..>.).[D..J...................;........4...4...4.."...............[D..[D..[D..z...y.. x.. ...........$........4......7...7........................;........4...4...4..........[D......[D....#.[D............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000G.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.087815809535008
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:xsYs0g/iR9sEAXM9KwTSRy2hBN0gkAse6g:xsYs0g/iDJAXM9Kw+RycP0gkAseH
                                                                                                                                                              MD5:C3A7EAA421437C877E2718EF4279FB50
                                                                                                                                                              SHA1:BF61CF67C5709346CAB51FE92F2FA0E891484D8F
                                                                                                                                                              SHA-256:99D0CBDA1920F377992FDBF5DD692725D0026C573498DCE2A4D99220A81A8B65
                                                                                                                                                              SHA-512:99B39F53F6D47B49A6D5DDCBD9D288A13BACA2BABF692EE81920656B93B0487A5373D945C438C25EF3686C700C35EC968984BD6001C93E97F28B999E5BFB657B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZ.N.......N...z...&L..".N...z...&L..".N...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............G...0.!.!Y.O,.....N...^.................6.2..C...p..P.........f........................................I.qk..B.....LZ.............G...0.!.!Y.O,..........G...0.!.!Y.O,...........N.......N.......N...........................................N.j.....N.T.]...N.......N...B...N.H.....N...B...N...>.).N...J...................;........4...4...4.."...............N...N...N...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........N.......N.....#.N.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000H.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.077403912778597
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:aOVsUUcILC6ZtyDoE3pCXI9sAToXrd6rw8IcdXYPrY3OQg:xsuQC6ZLE3UXI9sATaRiryQ
                                                                                                                                                              MD5:1A6BE5301DCE5BC1CB176F0C0334605C
                                                                                                                                                              SHA1:C5B9240302D333D67B10F802FC67EBCCD8A7DC8E
                                                                                                                                                              SHA-256:363CF0CA4F3B97E97532398B44C7FDE26C23EFD1359386B1B77354DC551B201F
                                                                                                                                                              SHA-512:AE6AD8DC8A077FEE2FE0CB38B9E6D9B1EB8D91AA25910F4764CEFB5AF20D80C34B42CA58F9CBF39AECF7BB6A4973C222D68E766C0EC98C15912E96A4C2E42AA3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......$...v.......................................................................................................................................2...>...........v...L............................I.......I.qk..B.....LZ.............B..l>x./<......B..l>x./<......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................F.#..5...1!b....N...^................1#{a..M.[a9...........f........................................I.qk..B.....LZ...............F.#..5...1!b...........F.#..5...1!b........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000I.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.053034352083881
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:ZsqVRSjU24dVtOcokElRX891SbKToJrdnrnQIj/2dX2p3qUz6kiK3N64qg:Zsxr4dV0cZEbX89sbKToRrn1OQE
                                                                                                                                                              MD5:64D62F930EF1FFF6A6F3C5974E4BAD91
                                                                                                                                                              SHA1:3C32DB1A9EDB48CF25BAEF361E550BB7CEF48567
                                                                                                                                                              SHA-256:E49119417FD3090F78745A0A403A0916CA1D35EC5C624EF81FEDA2AA0AC1E051
                                                                                                                                                              SHA-512:5A203D270A8A7F5F85921E9D14AADFAF995B2635F777F76D5FB9DFB61BDEABBA2F3C0C9713155C36469DA8152FA550CFDCAFDDCAB15F06C4F9716CD492B285B7
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......$...v.......................................................................................................................................2...>...........v...L...........................8.......8.......T....`(.I.......I.qk..B.....LZ8.......T....`(8....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............SR.d!..%..I.......N...^...............NrU)..{F..a...........f........................................I.qk..B.....LZ............SR.d!..%..I...........SR.d!..%..I............8.......8.......8...........................................8..j....8..T.]..8.......8....B..8..H....8....B..8....>.)8....J...................;........4...4...4.."..............8...8...8....z...y.. x.. ...........$........4......7...7........................;........4...4...4.........8.......8......#8..............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000J.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.06284792348101
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:a32sC4cPbXVUAeRI56xt07eMG9PEHhcXY9xQengTToardqrhIfdXFjzvzHsUNvc2:9sRvIQx20BEHiXY9xRgTTHRy+Pps
                                                                                                                                                              MD5:297FA6766300278C5570D3635558B20F
                                                                                                                                                              SHA1:D6B1024ADA47119772B403B52B593394F8F336B1
                                                                                                                                                              SHA-256:D3DACF44D9898E19C0DFDFC773A8490A73F8EF62CB118896D4D0137BA0C94A62
                                                                                                                                                              SHA-512:B0D8C6D4DE3A855FD545DBE60E4ECC2A52B3249D031C7C4F5FEA7148CE54733720385FDA6253BA2618683A29583D826B17751B738F088370506B0A9104D28F37
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......$...v.......................................................................................................................................2...>...........v...L............................I.......I.qk..B.....LZ...........[ .....c.~......[ .....c.~........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............y.j........B.....N...^..................6.T.A.C..?8t.........f........................................I.qk..B.....LZ............y.j........B.........y.j........B.........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000K.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.0902879491192925
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:YAQNs6hz63H+tTuaEEyIXbI9jjJRToordDr6IldXD1vRs5Elt:2s+63etVEBIXbI9JRT1RPJfbl
                                                                                                                                                              MD5:69BE88591AFFE33E7AEB53900411197B
                                                                                                                                                              SHA1:31ED2D1735813430DE7F40E982FD2FC7ADF1682A
                                                                                                                                                              SHA-256:BAA7A3FEB411159684F1DD9BA30CBD19AE61950B8D013595DF9F3EED0517CED6
                                                                                                                                                              SHA-512:BC907AA8D8D2F57F7C04F54F256209272A22918F063E488760DB3FCBAB4CEE3CCBF2E11D1771A5D84D606E7F26CB04B673977C0B9D98FC4019F166B72B519639
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ...........f=...?...#......f=...?...#........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............H...w...#..+d.....N...^...............\.;..E.D.!.O.E..........f........................................I.qk..B.....LZ............H...w...#..+d.........H...w...#..+d.........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000L.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.054531323985192
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:asH2R6wlREYrXE9eAsT6R2DUPjGJQPZsq:asHC6HYrXE9dsWR2DUPKJQPCq
                                                                                                                                                              MD5:BBEC8C1642A2AFA43FC488A206A94874
                                                                                                                                                              SHA1:37CA26BE9FE11511F0FDDBC2E407945F0DE2AFDA
                                                                                                                                                              SHA-256:95074AED3F8C29B94695A020670D8B6892439DAD8291029C76F8F1EF4CFD7B7E
                                                                                                                                                              SHA-512:A0942D90BBA447EB8C9C2C50E7A0A15BE02AE8A5DDC333920CEF746FC42D1C336D47F5EBCF8A40EB282CF77882A59764DFEBA01A821BB8B4C85EF5EF16A3D060
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZn.h.....n.h..b.....T2../n.h..b.....T2../n.h..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................7..75 w.3......N...^...............%....`<E..P.p. .........f........................................I.qk..B.....LZ.................7..75 w.3...............7..75 w.3...........n.h.....n.h.....n.h.........................................n.hj....n.hT.]..n.h.....n.h..B..n.hH....n.h..B..n.h..>.)n.h..J...................;........4...4...4.."..............n.h.n.h.n.h..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........n.h.....n.h....#n.h............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000M.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.051099789171122
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:Y4xr0sgMdvlUhvSSiti9CEn6rNXo9OYhToRvCrdvlxrDEIxDdXbFRglIIw+ON:tr0sGBSSiYkE4Xo9phThRHrDh
                                                                                                                                                              MD5:4D6BE84B5FDF6CF606E08EED28E83BFA
                                                                                                                                                              SHA1:CF1B571C2034C1482DE7551C06FA591B5ECED33A
                                                                                                                                                              SHA-256:BD319092FB2E546009BBA12BD5BE016536796E3D22386282679CA87E8145AB3D
                                                                                                                                                              SHA-512:D1A88545F85DEFB28A3340C29FD780C924C66FA17D54AC29B09E14A73358FB31F7EE3677B740B738088A895EA651D5040FA72551A90BD9FF2A7C31E2E736AD35
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZZ6a.....Z6a.K........ix'Z6a.K........ix'Z6a..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............'..V...\.#n../....N...^...............i....?O......=.........f........................................I.qk..B.....LZ..............'..V...\.#n../..........'..V...\.#n../.........Z6a.....Z6a.....Z6a.........................................Z6aj....Z6aT.]..Z6a.....Z6a..B..Z6aH....Z6a..B..Z6a..>.)Z6a..J...................;........4...4...4.."..............Z6a.Z6a.Z6a..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........Z6a.....Z6a....#Z6a............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000N.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.050155251991838
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:YBsdvYCOvgvyzHAODO/mjtG6EXgZ8Xo9aBWFToQrdPr5I0ArdXPdRdvgvhoVv5vN:KsqTAODO+j3EXgqXo9wWFTFRjdArJ
                                                                                                                                                              MD5:A7B361B20C3906308A7DA92326A46B61
                                                                                                                                                              SHA1:EDCD1ADB6078BF24F98EDC672895286DFDF6577A
                                                                                                                                                              SHA-256:465E60921786D42C655F5EB06A111A702C20050DB5871B2D4503203AED6B54AC
                                                                                                                                                              SHA-512:995481982EE3DFB43FF8E1DDE3157C2B687675C70F6B3DACF36A6B1AFF59D34D59049CD8C127627E0999D5FFFBCB11ADF3B4D85145DD48D1FFA6AA9F48B7C19C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ..e.......e.....8z.j.....e.....8z.j.....e..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............+H...A..y+....+....N...^...............i.PB.`.D.x...H..........f........................................I.qk..B.....LZ............+H...A..y+....+........+H...A..y+....+...........e.......e.......e...........................................ej......eT.]....e.......e..B....eH......e..B....e..>.)..e..J...................;........4...4...4.."................e...e...e..z...y.. x.. ...........$........4......7...7........................;........4...4...4...........e.......e....#..e............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000O.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.073076872546607
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:ysTIh0MOnvEfXc9rXxLThxRI/mZTEaZOXE:ysTu0MOcfXc9rBLDRI/mZTEaZcE
                                                                                                                                                              MD5:288424A1B4965C8986AEC25B8085D988
                                                                                                                                                              SHA1:146A1916883C1C7E37BB1BDB3B6C937042B8595E
                                                                                                                                                              SHA-256:56E0D62323A121917E747B576E077CF2377C30301FC4B7D645E6C406D2861F68
                                                                                                                                                              SHA-512:7B3A5D0CA537B8B9E79A75A61BE7D6AE851C9179E1C892C10DD088FC65FA172568274A390C4A044D18D384D17322B883FACB5F4E42957FD3AD4176527E5DC691
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZVWt.....VWt...I......DF.VWt...I......DF.VWt..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............4.......Gg..8....N...^.................%..I.K..P\...6........f........................................I.qk..B.....LZ.............4.......Gg..8.........4.......Gg..8.........VWt.....VWt.....VWt.........................................VWtj....VWtT.]..VWt.....VWt..B..VWtH....VWt..B..VWt..>.)VWt..J...................;........4...4...4.."..............VWt.VWt.VWt..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........VWt.....VWt....#VWt............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000P.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.090298426777373
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:sDs9sRlFK+KepEfZXA9R7TfRf51s6smasisbs6sUisds:ysWbFWeWxXA9R7jRf5+pUBgpC2
                                                                                                                                                              MD5:E0AECB9BA5E441A1CD912220763E62CA
                                                                                                                                                              SHA1:C6DDDF88EE55D8522ED1834C37F88A3A0D402004
                                                                                                                                                              SHA-256:007D48C9C299133AD24448709685FCD25CB60A6E42E04494D5F31DEFBCCB017D
                                                                                                                                                              SHA-512:A3D1B1CB7BD78DDD16BF9D3A0EBA31AB3DCCE2617C9BEA112AC7E6102DA483709B05DB08DB9FBEA214C8D703B338ECE772E668E80178C5857036CFC76027982B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ.........SD......^..5...SD......^..5.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............%..YE.r...%.2.......N...^................U.....@......a........f........................................I.qk..B.....LZ............%..YE.r...%.2...........%..YE.r...%.2.......................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4......7...7........................;........4...4...4......................#..............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000Q.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.079846611025151
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:JoDsEvfX36zGPEFEXn09hzNTlReI6WqTe4n:yDsEvfX36zZaXn09hzNhReI6WqTe4
                                                                                                                                                              MD5:2E4A45C7C37868B1D04734834670BEA5
                                                                                                                                                              SHA1:E5FC32C637F9932195525C0BA611C49A3DC48633
                                                                                                                                                              SHA-256:BCEC89D3C797F9BEA20B814ABF37712EDAE364AE2233D9A7740AEBF90E6F38C1
                                                                                                                                                              SHA-512:0722DB7F7773E81F6B57E019F61D3C607D0BAD271673139FF0D8EB02F94E63F6CF5527899DCA94FF961D9E0306D24D521FADA47F363D643A80340D0BDB5EC68B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J...........................{g......{g.....?..';....I.......I.qk..B.....LZ{g.....?..';...{g...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............a.....^.....'.....N...^...............A..-...G...;. Lx........f........................................I.qk..B.....LZ............a.....^.....'.........a.....^.....'..........{g......{g......{g..........................................{g.j....{g.T.]..{g......{g...B..{g.H....{g...B..{g...>.){g...J...................;........4...4...4.."..............{g..{g..{g...z...y.. x.. ...........$........4......7...7........................;........4...4...4.........{g......{g.....#{g.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000R.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.100375719848043
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:lXzsnQrtuV8E4KXtZ9K9mZFT3RfH62yk:JsnQrt8ZXXtZA9mZFTRv6M
                                                                                                                                                              MD5:B8FADB8E5C6179C96D26107872B7CF1C
                                                                                                                                                              SHA1:435D411C5830F2200CC3A723DE9FDF244D19A033
                                                                                                                                                              SHA-256:7FAE692398DA477C589F124CF906F9B1D1DAB0A2D533F78CC149CD90E227D9F0
                                                                                                                                                              SHA-512:F16489007EA5A7C144EAEF7D059E3DAEFB7294C00D5D8E987C09BC8405B2FDD3FC354B76639E6F94E6EBF0062BBA1CAF4B0F8D5BB5FCB239F14157DA65FF415C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZ..6.......6.u-..?......h..6.u-..?......h..6..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............X*.bsJ. .\/.C......N...^................v..#(TI....."..........f........................................I.qk..B.....LZ.............X*.bsJ. .\/.C...........X*.bsJ. .\/.C.............6.......6.......6...........................................6j......6T.]....6.......6..B....6H......6..B....6..>.)..6..J...................;........4...4...4.."................6...6...6..z...y.. x.. ...........$........4......7...7........................;........4...4...4...........6.......6....#..6............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000S.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.093544699707061
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:tspV6ozMbocERXsd9SiTwRpuaZW3b6fWmsVd3:tspV6oYo5RXsd9SiURpuaZWr6fWld3
                                                                                                                                                              MD5:EDAE92047CA19C7609FCAFAACB5466D6
                                                                                                                                                              SHA1:2D722E848BB25F7AD909B1C03D36F250D01FE153
                                                                                                                                                              SHA-256:7A39888E13DCAFFADF71C456E69BD71D57463A9BE3A2CA956C9E7D691DA8D3DF
                                                                                                                                                              SHA-512:D700326251040206AE1C3134D0E5E5728A3ED8B8F7A44C0AE9EC01380A869EB18685E622D598EED11166F34D0FDA265FA6BA0BA1B1451218D8CE869D69C51AE4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZ...............>4..!u.8.......>4..!u.8.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............*..GI..............N...^................+.....J.EV.{..r........f........................................I.qk..B.....LZ.............*..GI...................*..GI..................................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000T.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.08832767112544
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:Yesw4n+UhDjHmtxtoEdrXwh9n+1fdTosNrddr3IZdXfmkiyfsa:Ns7jHmhoEZXw9n+1fdTtRRawl8s
                                                                                                                                                              MD5:AC953C9F74A71B6D4C7A5C5035107E32
                                                                                                                                                              SHA1:5FAEB151D8A8184455838D33BEDA375FCDAACE8A
                                                                                                                                                              SHA-256:8C8573B73B8C0A4885D4B9E3DA97DC5C8EA1AEB81238D3863EBFBCEFD87A2F9A
                                                                                                                                                              SHA-512:9F6BAF3986F2BE96F8E250CC8AA9A4C3FD57374CCECFF83F5B545F5CAFDA97A35E1169CD0FCD1020B0D1BA2DA15C9D6B576D43EDF84DAA57713A2E8ACADA3A4A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZY.......Y....lx.....z$.IY....lx.....z$.IY....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................|.....}.-f.......N...^.................{L.7%@..P@+..........f........................................I.qk..B.....LZ...............|.....}.-f..............|.....}.-f............Y.......Y.......Y...........................................Y..j....Y..T.]..Y.......Y....B..Y..H....Y....B..Y....>.)Y....J...................;........4...4...4.."..............Y...Y...Y....z...y.. x.. ...........$........4......7...7........................;........4...4...4.........Y.......Y......#Y..............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000U.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.169498673138827
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:isPFqGRuAN0tUE4Et0LX4L9Ka+ToNrdjr2IidXGHhRqXmwoxig:issAN0KhEWLX4L9Ka+TcRvq0
                                                                                                                                                              MD5:9EE855B59B3EF84CF490086E1B3C5930
                                                                                                                                                              SHA1:3B77D7345F039F4CD1D67CF6321F8C59A8FD07E5
                                                                                                                                                              SHA-256:1C6EF4AD40F8796090F6D42071D5BC53F4684213EEAF79A8E85DF2FD1264229E
                                                                                                                                                              SHA-512:463461B71C323AF4E61FDA5CC576CDED81550A18802E796768DFF56DDB929852FC7CB1FBCB859BFA7BF3BF8741F3275BBC9A989D3DDDC3B8DAB0E0EEF88B8C60
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......0...v...$.................................................?....?............................................................................2...>...........v...X............................I.......I.qk..B.....LZ..............c...Q...H.......c...Q...H......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............$..oQ.......b.....N...^...............U.L.T^2J.e...kS.........f........................................I.qk..B.....LZ............$..oQ.......b.........$..oQ.......b.........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000V.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.1769515329533515
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:ms8PUHAVaLtNtUEPlOlzX+z9sWUxTourdQrSpIcdXsTPcAlpig:msmVaLFUEPkXM9sNTrRIaiV
                                                                                                                                                              MD5:F31EDEFFA3FE338B9BD5FB8C3B23FF9E
                                                                                                                                                              SHA1:883B90B1EEDFBF092F5E07AA3EEC0DA0C4E4B3F5
                                                                                                                                                              SHA-256:642B1FA791B62EB6F33A55E52AC9B1BB7E62D4EE742E71CE09C132FF85B924A2
                                                                                                                                                              SHA-512:9ED812832FD0B0D62746A9B959CE44431DE51C3B5C28C6B6AD65712FCE1AE592691BA99657B4BA3B22A69E54EC7537F79AD332F5A26865615CBE8FF05941466B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......0...v...$.................................................?....?............................................................................2...>...........v...X............................I.......I.qk..B.....LZ.........Z.l .?..L\.u...Z.l .?..L\.u.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............EIc.&.....<..+.S....N...^.................yI.!A.ts............f........................................I.qk..B.....LZ............EIc.&.....<..+.S........EIc.&.....<..+.S....................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4......7...7........................;........4...4...4......................#..............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000010.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.109566310649376
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:uIsQCd/7mKGmNSOtO7OEBAC+reXY59DFVvTo70rdSrK3IxdXn61pR:uIsxqKTNSOMyEBA7CXk9DFRTo0RKXe
                                                                                                                                                              MD5:E1CADCA8EA9F073CB786D7645E18ACB4
                                                                                                                                                              SHA1:7EF435D2D5AABC2AFAACE1EA6B6B81562BC61314
                                                                                                                                                              SHA-256:E58C855E0DA335A05DDC5E7FB4379F7038C74FFE5D7414A332EF8F0A09D2732F
                                                                                                                                                              SHA-512:D518C304B703D1F841B4DAE776649092E9527CF0B41CE895933ED02C76064A538B246EDA0B6D52382694BA77168F95406C71B52A91082E6F00E128E6A7C3729D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZb#......b#.J..p.......XXb#.J..p.......XXb#...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............h.Q...j...B...%.....N...^....................FH....b.i.........f........................................I.qk..B.....LZ............h.Q...j...B...%.........h.Q...j...B...%..........b#......b#......b#..........................................b#.j....b#.T.]..b#......b#...B..b#.H....b#...B..b#...>.)b#...J...................;........4...4...4.."..............b#..b#..b#...z...y.. x.. ...........$........4......7...7........................;........4...4...4.........b#......b#.....#b#.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000011.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.107645010965627
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:1s+cHDKnc8E7dX09+TeRKwtbcc+7bcrxR:1sZHDKcZRX09+yRKw
                                                                                                                                                              MD5:6F80C36B7ECCFE2353555C138D135610
                                                                                                                                                              SHA1:4F7CB94C72E3D9C5D1EAFFC649D29FC9FA58AE8F
                                                                                                                                                              SHA-256:05F01DA8DFE45BFB86CD6D8FE0F928EC2BCC81E8CD9F0C6AEF6F031101D8F34C
                                                                                                                                                              SHA-512:D676E59C582AE1CEFCC893138ED9EC4A702E64CF3A2BB1A57F6AE80C82FD5014320DC22230DA556EDE4DEE422209AE9D54965690B38BC71308DC68FB7C8E5123
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ................*J.<..........*J.<.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................Fl..)ke.5.g*....N...^.................D....I..1.;9..........f........................................I.qk..B.....LZ................Fl..)ke.5.g*............Fl..)ke.5.g*........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000012.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.106333944248599
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:Fsq/rgrBsdteuoWEEC/WYfXbPYf9S95r68ToZrdSrnIadXKemGpt:FsPBsdgqEEkfXbgf9i5rzT8RKRJ
                                                                                                                                                              MD5:71FBB8684A6B1E5B0135D6EC04EFA194
                                                                                                                                                              SHA1:EF5ADCBD9029368596F315D5B7FA735E50B8A1E8
                                                                                                                                                              SHA-256:F4D6C3035032B8292AB3DF3A65A1F28C688A2BA04C4E862195C09A1510BB3E53
                                                                                                                                                              SHA-512:015528AA5F6259BA25C59F2DBCDAACB139F4A40B22CB35453412D80C4BC54654114BECFD10D288C8ECB5D332346183B46E458118823758B97DE82AD784BBC6E5
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.~.......~..4....s..S..?.~..4....s..S..?.~...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............cNH*.I.......k.....N...^...............o...#&7D....o.........f........................................I.qk..B.....LZ.............cNH*.I.......k..........cNH*.I.......k...........~.......~.......~...........................................~.j.....~.T.]...~.......~..B...~.H.....~...B...~...>.).~...J...................;........4...4...4.."...............~...~...~...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........~.......~.....#.~.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000013.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.122931646988241
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:BsVSlZ0sBaEBt8+E2CHvkXvk9zoToTJrdSriI2dXyJVCds4kdPwKvWVrc81:BsVtsBaEBZE2UkXvk9UTERK6Ls9PpW
                                                                                                                                                              MD5:FFFF98969F50527BE7B7F2BEA4CC45B2
                                                                                                                                                              SHA1:7B6FE8883381C40713F4EC940EAA0CCD5712BF5B
                                                                                                                                                              SHA-256:461AEDDA573B4FF61D60CD4992E02A4BE10C3ED3AABD2C02A36ED32463176019
                                                                                                                                                              SHA-512:70E00556A461A527EBC60D85326A770DDB59E2EE709402326BC5CA3E1826308FF94BC786BFC6E6842CE13D69B35CE85C68378318A57790D232B512311C418E2A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZf0......f0.U..].7.......f0.U..].7.......f0...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................In...'.b...o.....N...^...............~.]..-.F."'.............f........................................I.qk..B.....LZ...............In...'.b...o............In...'.b...o..........f0......f0......f0..........................................f0.j....f0.T.]..f0......f0...B..f0.H....f0...B..f0...>.)f0...J...................;........4...4...4.."..............f0..f0..f0...z...y.. x.. ...........$........4......7...7........................;........4...4...4.........f0......f0.....#f0.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000014.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.128690181451724
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:XeSsOBr1z2SNitmz7xeEG9CCZPX094SSTonrdSrlIsdXUDxpxISEmlMpxhQqX:hsIz2SNiM8Ei/X094ZTyRKVAzo
                                                                                                                                                              MD5:2727AAE970CF21F519475B7D1AEF63DE
                                                                                                                                                              SHA1:F3A870A835E8785559B460FE2F61E5B234F9779E
                                                                                                                                                              SHA-256:4079F6334880C565893AC6CB60769FCAEAC4D8DB6F294D10F56C13248EA2C829
                                                                                                                                                              SHA-512:C51BB4FEA920CC77C55CC56AB2B5A9C39A9A616EA0305A8C53E9184B5314D75A0C87A37B30D0058483BD95919840C7033447E23755FDD36594332327F63CBB3E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZV......V..[|G.>5JW.L..V..[|G.>5JW.L..V...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............F..{.....{u..e....N...^...............'..a/EAM....Z.[.........f........................................I.qk..B.....LZ.............F..{.....{u..e.........F..{.....{u..e.........V......V......V..........................................V.j....V.T.]..V......V..B..V.H....V...B..V...>.)V...J...................;........4...4...4.."..............V..V..V...z...y.. x.. ...........$........4......7...7........................;........4...4...4.........V......V.....#V.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000015.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.148580222466502
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:1sfV4WL39x5pE15XI9yAT/RKef7emt5zGv:1sfV4m39qbXI9yALRKefamt5z
                                                                                                                                                              MD5:D78B59CD7276655E755D2FFAEB3A2CC0
                                                                                                                                                              SHA1:81B7294C4CF780379E5F8FC7EA3395BD97BD5B79
                                                                                                                                                              SHA-256:CF47D5EDD4E8F4484964743BC5B94A1956E332316A940FEC440BA2ABF10A9589
                                                                                                                                                              SHA-512:94F3C93FED689AD8360639D8E974FEA0512CA0314662980467B3E51FEFA2772127F843EFD0CD0D0CB1BD7EEE903407A6CA0FCAF1CC3780B55D22D0A2B07128AD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.j.......j.e...%....W..j.e...%....W..j...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............#..f"4.2....^.....N...^...............'...oD.a.b.,..........f........................................I.qk..B.....LZ.............#..f"4.2....^..........#..f"4.2....^...........j.......j.......j...........................................j.j.....j.T.]...j.......j...B...j.H.....j...B...j...>.).j...J...................;........4...4...4.."...............j...j...j...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........j.......j.....#.j.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000016.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.116801980842352
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:bBs7+2qwNrONtYWEmCK5XuFX9DxToIxrdSr4I1ddXxJQIEp7N:bBstqw9oNEmHX091TxxRKjds
                                                                                                                                                              MD5:72BF1EC1633E94DA128E1B4973E4B5C8
                                                                                                                                                              SHA1:784B228C7A6AEFFE29DE0EAD9075A3248EF7D357
                                                                                                                                                              SHA-256:F1C7450D09016A6E689D84D926D97B631BF3B12464C903316E43A43EA1A55A5D
                                                                                                                                                              SHA-512:34E3CC3B36592F6D6513F49BE6F9EF5AE50A6DE479EC47A3DCA412188CB65609F9B7B4EDFAEA4292CBB22A3E431753E7F0481B715F5CEB6766295F89F1A34A4D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................Q.......Q... .6.-K.\...I.......I.qk..B.....LZ.Q... .6.-K.\...Q...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............n.V.i....6...|....N...^..................b(?/C...KA.Q........f........................................I.qk..B.....LZ..............n.V.i....6...|..........n.V.i....6...|..........Q.......Q.......Q...........................................Q.j.....Q.T.]...Q.......Q...B...Q.H.....Q...B...Q...>.).Q...J...................;........4...4...4.."...............Q...Q...Q...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........Q.......Q.....#.Q.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000017.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.144487319524614
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:KHudsHtNQ125cb747JteUElCC5nIX3I9KGJToBXrdSrCIMcudXe90QE1Xl6OPYTG:KHuds75c4FNElCTXY9pJT8XRKA95UK
                                                                                                                                                              MD5:B8836B48BB90751E0A5AF358360B2785
                                                                                                                                                              SHA1:523A328318742AB3C653DBAA3D7F6799B682C8CF
                                                                                                                                                              SHA-256:40FB174A477B207E1E1AA7851BF444A46451F5071ECD7525AD8E58D310BC5FA9
                                                                                                                                                              SHA-512:94AB46051483FA15083C47A95326EADCECCE70033A509EA39D2E1D1E907B5EB4A80EC133E3C7E3114C4AEE36A7A7ED885862119F218FCDF196BE5E06869DF153
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......,...v... ...................................................................................................................................2...>...........v...T............................I.......I.qk..B.....LZJ.......J....5..5.-Q.X..J....5..5.-Q.X..J....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............Rj.?..;..P%P......N...^..................^W.H....z..........f........................................I.qk..B.....LZ.............Rj.?..;..P%P...........Rj.?..;..P%P...........J.......J.......J...........................................J..j....J..T.]..J.......J....B..J..H....J....B..J....>.)J....J...................;........4...4...4.."..............J...J...J....z...y.. x.. ...........$........4......7...7........................;........4...4...4.........J.......J......#J..............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000018.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.104080172641677
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:K0bsBqN2hMLXC46xlO8qtC7sE6tiC+GxpXup9JurXFDToOrdSrXI7dXRnVz0QqhJ:K0bsPmXWxjqYsE6c74XY9JoTrRK02j
                                                                                                                                                              MD5:2AC60918AB7A43F752F88495DFAB9CBD
                                                                                                                                                              SHA1:72E1FC4E41E3D7C0C5928624E93072657A16A79E
                                                                                                                                                              SHA-256:0F871E37130865E39C430103CEA63506BDDA9466093E05F805F2156A70070C9C
                                                                                                                                                              SHA-512:0C4A4A77F8B09583A85160F63DD386695339A02EE3FB6808F82286F43CB3DDFFDA6C5D9EC49AE0B8B8712B2B54D4BE856AF0CDDE70240E71F684176B11CFE9D3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......,...v... ...................................................................................................................................2...>...........v...T............................I.......I.qk..B.....LZ..q.......q;.n....w...Jr..q;.n....w...Jr..q..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............%..2...*..w.-.e....N...^................@h.x.hB..b`..f.........f........................................I.qk..B.....LZ.............%..2...*..w.-.e.........%..2...*..w.-.e...........q.......q.......q...........................................qj......qT.]....q.......q..B....qH......q..B....q..>.)..q..J...................;........4...4...4.."................q...q...q..z...y.. x.. ...........$........4......7...7........................;........4...4...4...........q.......q....#..q............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000019.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.143585150551341
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:Q6dOs4ALmVQGGEP8IXHI9cY/A6DZTGRKN1oY:NdOs4ALmuCUIXHI9cBeKRKN1o
                                                                                                                                                              MD5:6D0C405E5C5B42C57D1400809A80AD26
                                                                                                                                                              SHA1:D46AC4D302C727E641C13A6301893C394D66ED0A
                                                                                                                                                              SHA-256:8A2A70D4CBDD773DE77FEA48626C09D7BB958EDDA4256737EC3D9DFF68FB442C
                                                                                                                                                              SHA-512:234D2B3A5B4EA08D2D24D7B2BA2F2F7CAA3BAFC8F62A5790453B5E4EF7AE6496EB6EB8B9504E1F5D7FCFFFCAA94D0D77E53C30B4ACD11B0358C4F8530AB2CF78
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>...........v..."...................................................................................................................................2...>...........v...V............................I.......I.qk..B.....LZY......Y.6~..+..aR1..Y.6~..+..aR1..Y...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............qg.7Q.C.=....Q.|....N...^...............f.f...e@.#..............f........................................I.qk..B.....LZ............qg.7Q.C.=....Q.|........qg.7Q.C.=....Q.|.........Y......Y......Y..........................................Y.j....Y.T.]..Y......Y..B..Y.H....Y...B..Y...>.)Y...J...................;........4...4...4.."..............Y..Y..Y...z...y.. x.. ...........$........4......7...7........................;........4...4...4.........Y......Y.....#Y.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001A.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.083392503387468
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:Js6jX5KYM34tkQSWEVC/lXY9TFiWjTo0rdSrSIySdXXmyKPoy3RT9:Jsb34BEVwXY9xJTtRKli
                                                                                                                                                              MD5:53E6B102115348BD3C0D3C31EB253756
                                                                                                                                                              SHA1:9D874A2CE758B125F62D6224EAEA05DC4D525348
                                                                                                                                                              SHA-256:5C5EDBF4BABFCA1ADF3E5911087098380C644A597946834616504A712C86AB1B
                                                                                                                                                              SHA-512:FA2EC71D257F9E6C6732CB4EC393A06B686CE9B08821EFFDFAF8C6460C943C730CB086292E164F41BF28AFE9BD980C81357B6ACBE01C4428AF8C29B70D83EE8A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ..Y.......Y;.......8.,...Y;.......8.,...Y..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............q.>J?8+.0.....L.....N...^...............*O.....J.k.}U(.8........f........................................I.qk..B.....LZ............q.>J?8+.0.....L.........q.>J?8+.0.....L............Y.......Y.......Y...........................................Yj......YT.]....Y.......Y..B....YH......Y..B....Y..>.)..Y..J...................;........4...4...4.."................Y...Y...Y..z...y.. x.. ...........$........4......7...7........................;........4...4...4...........Y.......Y....#..Y............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001B.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.132097407088457
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:5c6suhzlluDG6otYyEsWCjtwXo9s9PCmmToerdSrYEI0qdXpWUG0y:5c6sUS5ohEsWMiXo9yyTzRKKw
                                                                                                                                                              MD5:C93CD9F5A99CC2621F1F6C721983BE04
                                                                                                                                                              SHA1:82975378E49231B261DD6E4C30EB07B3F32B6D67
                                                                                                                                                              SHA-256:67672AEC3F749B7F948429C50D7549D26EB1FECD412CF7AC212F069D18A02B5A
                                                                                                                                                              SHA-512:7EEBC1C9ADCCAC115AE98047A87CBE2D9EB1A49FE45073A7A325703D70D4082D5B752B3B6C2A7624FECD298BE6C70571D18475DA8BFC4C30428BBCF6B93BE571
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.............<.|./.}.....<.|./.}.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'............./...T./..O?BV.....N...^..................z.D...0..U=........f........................................I.qk..B.....LZ............/...T./..O?BV........./...T./..O?BV.........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001C.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.119444585815578
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:Rsdwe2dVl+pNHER3c1IX3I9UvTORKA5ebg3hV:Rsdwe2dVl+nkxOIX3I9UvyRKA5ebg3h
                                                                                                                                                              MD5:AA921211B0675FC9929C8314155BEB21
                                                                                                                                                              SHA1:F21BFD89E8220ED1F34F5CC19CA2C4EFD1C9C7D2
                                                                                                                                                              SHA-256:F044034A05206F26DA54456CF76883DEC5143E39464DF6130677960EDB864074
                                                                                                                                                              SHA-512:3FCC66BC1EB8DC4346CAEB0636F0A0E3C8CD58EF8AEBDF55E6FC1CE7D75D6EEE5E7456F947FF5F40A8D0F3A180FD5B951800D649AD3AAFAA6F9182EFEDF8B369
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ)i8.....)i8_\...8-):....)i8_\...8-):....)i8..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............{.K........;.hnu....N...^...............Z..P...M..>.}:..........f........................................I.qk..B.....LZ............{.K........;.hnu........{.K........;.hnu.........)i8.....)i8.....)i8.........................................)i8j....)i8T.]..)i8.....)i8..B..)i8H....)i8..B..)i8..>.))i8..J...................;........4...4...4.."..............)i8.)i8.)i8..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........)i8.....)i8....#)i8............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001D.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.104576664380145
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:psk/wU9kJENA1s2DXc9VgDBTURKsGt1d:psQwU9VyDXc9VgDBIRKsGt1
                                                                                                                                                              MD5:B48EC71D36E1AA23D752D69F387593AE
                                                                                                                                                              SHA1:36C7EE6BDD3C4EC79D8243FD7E3D5E94EE5C05C5
                                                                                                                                                              SHA-256:02C3D0CCFC5E6E16A47EE0461E767963B5C27A0874C78792E26515E213A437D6
                                                                                                                                                              SHA-512:E5223FAB23BF5F09830912ACFB665F02194752A0C30A0F8532674CC4EDB2B5933D2B68AD6E215032B45292DEC9587E5FAFFA1F6C078087A3E337009B0254602A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.h.......h.2.[....M."c..h.2.[....M."c..h...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............|,...p.#..oya.....N...^...................s..K.0a../..........f........................................I.qk..B.....LZ.............|,...p.#..oya..........|,...p.#..oya...........h.......h.......h...........................................h.j.....h.T.]...h.......h...B...h.H.....h...B...h...>.).h...J...................;........4...4...4.."...............h...h...h...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........h.......h.....#.h.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001E.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.132491661256422
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:KEsGmIdYuUt+k3CzvIEyrCQGXA9vZM9eTo/rdSr5IEdX8l0QTDq/d:KEsyYuU0zwEyr2XA9xM0TGRKx9
                                                                                                                                                              MD5:E41A5D05DC703434210F6A5CE5AF6A7C
                                                                                                                                                              SHA1:26DB12747E65A257EFF303C526C2F153C8BB5CEA
                                                                                                                                                              SHA-256:DE4EFB2EE73F5048498641FB5E7E8C438B27D80C8862E3BD3A0F802A85C703F0
                                                                                                                                                              SHA-512:294092020169B96DF0528E85F7A02E96095D560353372C047685BD99940D7057F3CF9B2544338A09E2FD0AC6F4C108AE0E3CE4FC47F551D8F37B068E4C773144
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......,...v... ...................................................................................................................................2...>...........v...T............................I.......I.qk..B.....LZD.{.....D.{.H...4B..5.TD.{.H...4B..5.TD.{..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............J...<y...}.........N...^.................&I(yqF..P............f........................................I.qk..B.....LZ............J...<y...}.............J...<y...}..............D.{.....D.{.....D.{.........................................D.{j....D.{T.]..D.{.....D.{..B..D.{H....D.{..B..D.{..>.)D.{..J...................;........4...4...4.."..............D.{.D.{.D.{..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........D.{.....D.{....#D.{............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001F.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.123354192382561
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:masuNUr59qhpt/MEJlCDUXHe9HPQ5wTojrdSrljIwdX0YFmpeXMdf:Psh59qhpuEX1X+9vIwTiRK1bFNMd
                                                                                                                                                              MD5:CF97767760FDE0738A874F0FF6764E81
                                                                                                                                                              SHA1:E72710CE2A2F9E261E31E8D2663929F3648874B7
                                                                                                                                                              SHA-256:1DA406AF5CC5DE5D524549E103271F75D35F5ED532EFE8BCDA1C2A908C3C960E
                                                                                                                                                              SHA-512:C3D91BCCA4A4EEE55E2B371EAC4E3AA6B7E51A647A8C2E5BE04C0B5AD32DDA2A20B36DFFE28953DA35EBF07BE745E4776B6B48CDBFA0D39AFFF91460580D2C2E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......(...v.......................................................................................................................................2...>...........v...P............................I.......I.qk..B.....LZ............f...%3....A....f...%3....A.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............bg....U..)..Y.......N...^...............l...0.dA.jrn.IiC........f........................................I.qk..B.....LZ............bg....U..)..Y...........bg....U..)..Y...........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001G.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):3.560886524060614
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:NVu6Wc9LC/qF5tBAEG4IEdEPc4IwH4Iw0w:8c9Aq7dODPUwX
                                                                                                                                                              MD5:8F1B9508DA32CAB86EABB2A3393227EA
                                                                                                                                                              SHA1:3B174B389077B79F843F32B2CE6F9BFF4CD30B47
                                                                                                                                                              SHA-256:628FE39268B91F2E9CD80231C8ED64EFBE2D37F338314E9B758C735A6CE75A85
                                                                                                                                                              SHA-512:B1B1B4013C8E542C7C592DD624F7D51304FD76CF9B75BBBBB0F707D0E21BCF8EA50B25B30B6591371A62568CF20891865C9408E31A00CBC1A12D9CA52FF4C21F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:\...................................................................................................?...................................................\...................,...........................5.......5...W.......I...r.......r.~...C.4..."i...\..... &.".........Q..N..$.;BLa....Q.N/.n{&..(.k.*..EN/...........U.......U...................................................ms......ms.g..."f..{DC.U.......U...'.M.<R.h.#..2...........^.......0............r....C..b..ms......Z............r.T./....CT.v...bT......vT)...U.......U...."..U....n.....T)O.......b......Z...c..,0...e...B4.$...........GP..A..}.....J.....................r.~...C.4..."i.r.......xcG....E.......btS.fI.[.].y...b.....>...............N/.n{&..(.k.*..EU...'.M.<R.h.#...btS.fI.[.].y............0...........e....4.............."...P.r.o.j.e.c.t. .O.v.e.r.v.i.e.w.......B.^....F...r.QH.....(...........(..."...P.r.o.j.e.c.t. .O.v.e.r.v.i.e.w...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.r...P.a.g.e.V.e.r.C.o.m.m.e.n.t...P.a.g.e.O.v.e.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001H.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):20480
                                                                                                                                                              Entropy (8bit):4.624309702045867
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384://3RQ3y32Ivf5ei/aPmRtCLHBOuJ+7SVz+kQtxyz5z6NjNbmz4CwDmDSG://3eC32Ivf5ecaPmRQLHMA+2Vz+kQtxm
                                                                                                                                                              MD5:56869A26DAFF7C000DE7FF6ABD36BBC0
                                                                                                                                                              SHA1:D41546BA12E29D163BEE903E6167EDDD612C9FE4
                                                                                                                                                              SHA-256:4BBB4680A5FE6346F007B9C105581EF1B7C71B4C8DCAF983A7A3622A63C504E0
                                                                                                                                                              SHA-512:7DE7C5D1981670EB8260F06C5EDD6EB5F6857EB39166C57D14744D5B148640E10598944B498EF8513F3D9D5C619A53C454F1766B68334D05E098BB68454C6FC5
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....>...........v........@..( ..`J..........>...t...8...v........H..( ..PI..................................................................................>...........v........I..( ...I...............I.......I.qk..B.....LZ.........V....<0..x.G...V....<0..x.G^.....8.....$...M.....8..I.qk..B.....LZ.I............I.......I...................................................I.t.....I................................................................4..'...'..............".......B:;.x......N...^................0w.~.@.W....<F............J...............................4....I.qk..B.....LZ.............".......B:;.x..............................................................................................8(.6....8(.z....8 ......8$......8 ......8(.5....8 ......8$..........3..8....z...y.. x.. ...........$........!..7!..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.3..............Z4...........................................4../4......p...............C.a.l.i.b.r.i.....

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001I.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:06:24], progressive, precision 8, 38x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):22203
                                                                                                                                                              Entropy (8bit):6.977175130747846
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:5q3R1VBvq3R1Flrk6Q0QPJJrR39joOVMJ25d1NkMhIwobbtAAAqYnLJZMJYZ2AC:xw6Q0WJR3FoOVMJIIlAAAqYnMJdD
                                                                                                                                                              MD5:2D3128554F6286809B2C8E99DE5FD3F6
                                                                                                                                                              SHA1:FC42CB04151D36F448093BDEFE33031A9B8D797D
                                                                                                                                                              SHA-256:14FA2D16310485AA1CE41F6D774A3D637E8CF8B03C4F72990155DF274FDB6BD9
                                                                                                                                                              SHA-512:D8531247A6E89ECABEA9C4A78F596CCE3493334EDF71AE4F7998FDDD0F80705948609C89756AB56FDFAB6D04DEC5F699A693801A772CA2EE2465BDD2CE5D2D5A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....XExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:06:24............................&.........................................................(.....................&...........*.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...H.....Go.Kxn.b..g...........%?_....O......q......7G......%%.V..8zm.].v?...jJ~._..>.......O;........o..rI.A.....n.a.........

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001J.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):3.9727414031823813
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:fsqZmD63hcEsXF3mDR/cMxpkt9Un3fa+R:UqQ63hcEuF3cR/RpkvUn3iq
                                                                                                                                                              MD5:4A25EFE1FD99F4749C9B20D5553D7F28
                                                                                                                                                              SHA1:3CD920C5CA50EF3CD805A8EB0E6E951B699A7ECE
                                                                                                                                                              SHA-256:5220C52FE6BCC74A737347A964125780AC164EBD6D18349666E8AB9D77D4F1A7
                                                                                                                                                              SHA-512:85533E414D506D39364BCF6B53FE542A5F9700FC00FBFBF8A53512725F22DBE3098E290956B0B4E08411FD4FEAC38CBF99BF19012F8AC64399C8B839637E1DD4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>...........v.......................................................................................................................................2...>.......Z...v...&............................I.......I.qk..B.....LZ.)b.)....)b.W.....6..X..)b.W.....6..X..)b..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............J..?....0.bW.-:.....N...^...............Mp!....@...I.ou.................................................I.qk..B.....LZ............J..?....0.bW.-:.........J..?....0.bW.-:...........)b......)b......)b..........................................)bj.h...)bT)....)b......)b..L...)bH.]...)b......)b..H...)b..}.......Z4...........................................4../4......p...............C.a.l.i.b.r.i...................)b..)b..)b..z...y.. x.. ...........$........4...!..7!..7................)b:.)bF.)bG.)b..z...y.. x.. ...........$..

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001K.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):52945
                                                                                                                                                              Entropy (8bit):7.6490972666456765
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:cjvqR0XvFaGCTJffi0tgybmWDoTw71kHUAnjvawrlp2+NUO8dWSNl3PF2PjK/q09:cyRffflgybmWoTw1UUADHUbU21MjpAD
                                                                                                                                                              MD5:AD003F032F32FAC4672D4CE237FA5C5B
                                                                                                                                                              SHA1:AE234931B452F0D649D91291763B919CF350EA49
                                                                                                                                                              SHA-256:ADB1EBBE18D6CD8FF08AA9BF5C83CDB83BF9AA179698E34E93DBCDDE12F04D32
                                                                                                                                                              SHA-512:ECA25FA657ECE3A66D3E650628E0F65D3BADD38864C028AB6553950A1A66D7D55482C85E9E565573E9E5AAFA91C2D53235971C644A266D41EB69F8E72E3A843B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQ..aq....".....2....BR#r.b3$...C.Sc%...s5E......................!1.A..Q.aq"...2...#...B...Rb3..$..CSr...6............?......y_N.e.H7?........W..w....k|...S..d.4.>.RW5z.$.i.)V.O....>o...c..*&1.D..O..".ufbb..1...t..u=..K...m...~.....F..-.fb:i..=f..C.w.[{..~.7k....;..:..3....4.....$..m]...}....~q...9T.#..7.~..8...q.N;c..ffo.w...W..d........../t_........lWJE..).>..v;:=....Rrw#.m.n.n...E...vm.J}2N*..|.4...80.#..e....t.J..ZQ.x|g/....F..e....k+vK...M..W.X.e.L..~...j.....kz....=...n:O.:..[.L,.+R...Y..zKNI....,..{e..U.'...}.......|..t.]...~...b4......_.i..../.......m...a..n...v.j.?..Rc.$G|.31..#..$?.........h.w....-... .a.%z..u......u.A....Fm..J.......G..[...w.....:....w/.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001L.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12288
                                                                                                                                                              Entropy (8bit):3.505688377779702
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:cu6sEirgP1hdFFRD9VX9LRUk2+RtguT/IayDMJhoa1Xx4e9M9FRJ8bR2m:X3EVxFFRD9dFRUT+RttQayEd1Xx4OM9+
                                                                                                                                                              MD5:439C61F81934C6C775B934DF8BEC606F
                                                                                                                                                              SHA1:5F753E0E42B6C562E6EEC15C968957B9840AA15C
                                                                                                                                                              SHA-256:32840E5623BCA7C4282BAADE1564F4C9F4528B5450D9C7699310960EF567EB23
                                                                                                                                                              SHA-512:0FDE292764AA36E223D39102EA68C536075E07DE0BA66EB61C6813E3E8DD38BEAFB204DD2182711AAD4DCDBB4A8E6C1191138811E6FE608817EC37E19FE83667
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>...........v.......................................................................................................................................2...>.......@...v................................I.......I.qk..B.....LZ....9......n.....V'p..VJ...n.....V'p..VJ.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............|.a.y..0..P.Z......N...^..................j)..E.S.....M............................................r....I.qk..B.....LZ.............|.a.y..0..P.Z...........|.a.y..0..P.Z..........................................................................j.......T.H...............\.....H.........3.......O...............Z4...........................................4../4......p...............C.a.l.i.b.r.i...............................z...y.. x.. ...........$........4...!..7!..7..................:...F.....z...y.. x.. ...........$......

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001M.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):25622
                                                                                                                                                              Entropy (8bit):7.058784902089801
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:EhK81gTCyJ/Gf9Aw3t8w8EtdPeGDh6bEi1Ie1u4ZbvgwTwrSRh7ZKNpIGY:IjcRXwdJvtdGsUbEi1IeY8vgwTyC1+Y
                                                                                                                                                              MD5:F8CCFC24DEB1D991EBE085E1B2D7D9BF
                                                                                                                                                              SHA1:AF76C22A765434AEDA134924C517C84107F4FED5
                                                                                                                                                              SHA-256:7354001527AB554C44E7D6981B86DD933B7DC2E0D3DC8512AD3EECD843245C52
                                                                                                                                                              SHA-512:818BC3690B01B30BC571E4CF45EC8D1AFCAECBAB003532644381F1CF730A5B3486862D08F7579B2D3D89167AD7DF35028881245C9550B0DA23D1F81A720A9704
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!...1A.Qaq.........."2Rr.#.t6..B..3S$4..v.b..Cs.%5..8..cUV.(.DEe.&Ff...T.d.......................!.1A..Qaq...s4....2r..S"BR.3....b#C$.....c............?..D.."}:......&&...?3..W.q*.......]...m.Y.k1......K).J...uV.b.../.0.E.H..4..W_T.[t.V.w.9.x.qe.L..o.oL.....d.\.....6.|.o...}..H{Yn..E...6Y3.l.e..D.:,.n.%...t...m.........,+,..|..n.....6.*...f........6.../$../Vi..H...e.f.F.zn.).n.E..2sTn.i...Yb?6+H&...Bf..*....z.o.^7[..u.:o....t.s=.....(.s.....f.g....q9o.u1L.N...smzE..[>...+\O....j.<....j.c.W.............U..+.F/.'..W...T./W...>i01./....j.s."..Q...{...a._~OW...Rp.)*.e..W..Q4)<..'..W...q...'..U..z..g......U}...O....w....0F:.N..V.3W.|..'z0.]...j..U[v..g$D.Lc[.e...UW.m0+

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001N.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):20480
                                                                                                                                                              Entropy (8bit):3.2140646305058858
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:yJsBDFYeOqAEe9LasyVYRRSWGOCL1/0GKW3X:yJsBDFYsAEe9LzyKRRNGOS1/0GKW3X
                                                                                                                                                              MD5:37F5A1C733FA678FB1DD3D87F5232A12
                                                                                                                                                              SHA1:9424BAFF944D5A181DE005EA508EB708BBBDC014
                                                                                                                                                              SHA-256:C80E2DEBDC61010693D89F2254DA86A9DA91F5445FA1E923B99100E28AFDD343
                                                                                                                                                              SHA-512:9C6C0818730E63B6579310D5FC05267A16D772287B998BA477AA6CF6515932F110AACD4CF53475C76D31E7DCB28C14AEBEF753232A8613A12080B73C3039BBE4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>...........v.......0 .../........;.X..)...............;.X..)..........I.qk..B.....LZ................................2...>.......B...v........-..............v........-..8....................I.......I.qk..B.....LZ....T......6..3.9F.6.K....6..3.9F.6.K......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............;.X..).........N...^................{B..5.A....y~q...........................;.X..)..............{B..5.A....y~q...............;.X..).....................................................................................................j.e.....T.........................a..................... .H.......z.......R...................!..7......}.....W.i.n.g.d.i.n.g.s. .3.......................Z4...........................................4../4......p...............C.a.l.i.b.r.i.......................z... ..$..............

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001O.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):15740
                                                                                                                                                              Entropy (8bit):6.0674556182683945
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:Elv3GG8/OOs+GouFdxMlxjoPyerzkpuOo2vPMc62PaJseZC+BJoS/:EtNiwdxMlZoPhzkpuOo2PMc6rX8+B6+
                                                                                                                                                              MD5:FFA5EC40DC9A0FD10EB9E6355142D6A6
                                                                                                                                                              SHA1:3D3D6A7E086B3C610C08F1F3E3F883604F06F2A4
                                                                                                                                                              SHA-256:D74C3973C8D1F7C77274691AFB1AA934940674341D7EEE563BE75E563281BDFD
                                                                                                                                                              SHA-512:6FAF2A24D06E6008F3579C7CEC90C2887462BDF83FAD7372FBB74B8DE90340B580E9836F309B68A9794597A598F7DCDA661C9A58DA6D8187C69083B7A17C9CD9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!.1.....AQ..aq.g..8...."r....2.FG..#.E..7.Rb..Cc..D.v.B..3s..$d.%5Uu..&6fW'w........................!....1Aa...d..5e.6.q...Q..."2b.c..r3DE..BRs4U.#C.S.T............?...u.&0...cV.T.I...1..=4....Ce_.g.q.=F.M:>)...k..pm..h..=........S....)Ja8x...b.).=5.q..0......k.M.....1?-.G.b&.5..Ep.8t...'...R)..ta.F$bXO]tW.b.6#.t.XWN..ZW......].....G....x&&f..'L.....7...\...'.8...~`.sa...............................................X........qo...SMk...'.V...i..hb.}&?/.k.:>l.^....>Y...<}...&.jY.Gn.MKejyV......D......gf.0....t.nw..XQ...H.B.....=8.UkR.....Hm..w..]...k...#Z...F../.gjWvf.....w.aZ].2..5..^...VZv..._.7..a.|...:.B...,f...............~....m.;_.....-.e.y.w.[m.].bu.b.f+.E++\.....Y..7

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001P.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12288
                                                                                                                                                              Entropy (8bit):3.7802903913498414
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:RsitRqBf0r2R1UyaQcKX4qffPPRtIFyb32LLdILaRv7W4XJNN9BIMV8hgx2DTIT:m2E0r2OQF4qPPRtcyiLj/XJNPBIMV8hn
                                                                                                                                                              MD5:3DAF7E3C131F29A5A3166851AC04FB8F
                                                                                                                                                              SHA1:BABB339BAD6717F472064C474AC7BD2C5B0D4F2F
                                                                                                                                                              SHA-256:975A0BDC8464BF5FBBD272CDA66F57D894752EB688E054A7BCCA1AD4E418D340
                                                                                                                                                              SHA-512:15136AA9310BFC334085F0A1283E32B2DCA366890367513BBBB5F07C8C539BC4528DEB6CD59EFE21166FEDE7B81DA35CF76653B20A6DDE7A748551305FA91F12
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>...x.......v........ ..`!..2...>...........v.......@................................................................................................................................................I.......I.qk..B.....LZ8...9...8..+.....0M.*.-.8..+.....0M.*.-.8....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............1p%.....6_.".......N...^...............q...> D.,..]...................................................I.qk..B.....LZ............1p%.....6_."....................................8.......8.......8...........................................8..j....8..T.Q..8.......8...n..8..H....8....9..8....V..8............Z4...........................................4../4......p...............C.a.l.i.b.r.i..................8...8...8....z...y.. x.. ...........$........4...!..7!..7..............'8..%8..8....z...,4. ...........$>........4

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001Q.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):55804
                                                                                                                                                              Entropy (8bit):7.433623355028275
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:gVvci05lhVbfBcWvBLeynluexaWqzww/u5:gVUZhHDljaHww/u5
                                                                                                                                                              MD5:4126992F65FE53D3E3E78F6B27FD49DC
                                                                                                                                                              SHA1:BC0D76B69310DA9B909D3EE4CECBFE5F386BFB45
                                                                                                                                                              SHA-256:3FBE3C1C238BD7DBC67F8CFF5F3BDDFD513C96A9851B9616477947D21DFF4B2E
                                                                                                                                                              SHA-512:624853F5E56D224C8188F122B2C4724F867D4099E7FAAFB9C945BE7E2907900ADCF4AE97AB08909CF94E96FB6F381E3B6396D560D93EB2731E4E69CBFE628F10
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d..............................................................................................!1...AQ.aq"2.....BR..8x..r#..9b....3....CS$.'.cs.......7Gw.(.4%5&..Wg.h......tEVfv..H..........................!1A..Qa.q...."2..u6....BRr.#...b..3s..d...7.Cc.$Tt..S4.5Ue..&..%.................?...,...8..{..S.y.N....%..q.8..H[5....o..xg........)c(.eO.YO..._D..x.U.....%.S.r.r._.^..Su.h.Q.t.:.#?....x..B.S...Q.....oqF..%..8'.qx....%.2JKjF..{y.w0.*a.RMb.c.Q{%....eW'..[IV..'ZW3...[...MN.....rO.:....$.i..7....Vrrr...I.r..M..Qo..j....q.^...N...J......%.J..)F...>$.....u........o...+......[...*..t....R}.I..R..S..GB..:......).6_[^Xft...F.1.....zP....,.#....MG.T..Q.F.....)Fi../.I...,%.voEb.b.Z..V3..FT.}..[Z{....wd.z.e.....QwW(.).t..\..'....:)<W.<..&k...caRT.X(..K.....:f...]...q..

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001R.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12288
                                                                                                                                                              Entropy (8bit):4.630567613318926
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:4sxSHbEhRKR1Il5ePQFoNfwqo681JiehKHftsWXXViUtFdaRtAzosmF4K6bUY9yB:txS7cRKbIv5uwqo6scUKfiIURtRsK4KZ
                                                                                                                                                              MD5:C36B3316B785D2F7EC7AFAFC0CCD7B3C
                                                                                                                                                              SHA1:CEB5CE81E7A2CF06F421692B54C781468A4108CA
                                                                                                                                                              SHA-256:920B2921092888FD6B76880F32222BF1B229995FC3BD5048613C94B89F60BAB3
                                                                                                                                                              SHA-512:6C8E0F5F86574835FFC16ECC187F610BD9485D8ACA174B75D013269EBF7BDB82F1E25FD6F3301997B0DBC35B4FC2ADF56A9866B823C89CDFA60BFAD88B3340E0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....>.......>...v.......0 ..h+......>...........v...Z...@...X*...........................................................................................................................................I.......I.qk..B.....LZ1.......1...ECd.;.p.u...1...ECd.;.p.u..g1....I.qk..B.....LZ.I.....]..nD.(&d..v..............I.......I...................................................I.t.....I................................................................4..'...'.............*rn...dF....|............................G?P|.pI...)........N...^........................................I.qk..B.....LZ.............G?P|.pI...).....................................1.......1.......1................................................|.....(.......(.z..1..j.N..1..T)...1.......1....b..1.. .......'1..81....z...,4. ...."......$>........4.."..7......A.g.e.n.d.a.:.........................Z4...........................................4../4......p...............C.a.l.i.b.r.i..................1...1...1....z...y.. x.. ..

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001S.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41893
                                                                                                                                                              Entropy (8bit):7.52654558351485
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:pZvVQkUbOHxx3pvVmO5rsP5gUdXwFMuv53knzyncaXgRDqPU:pZkijV5wScXwFMYknzucaXgRyU
                                                                                                                                                              MD5:F25427EFECFEE786D5A9F630726DD140
                                                                                                                                                              SHA1:BC612A86FF985AB569ED1A1EA5FFC4FDB18FC605
                                                                                                                                                              SHA-256:5A36960DF32817E8426BD40A88F88B04FB55B84BAEF60F1E71E0872217FDB134
                                                                                                                                                              SHA-512:B102F34385196D630F198667E874F25ADBC737426FDAE0747EC799B33632E5DC92999C7C715DC84D904342738930267AB1709870BDAA842243E4C283FE5E1554
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................!.1AQ....aq......"......2...Xx..9BRr#.b3$..&..g.8....%F'G.(H.Ss..D5E..v..W..Cc.deu..7w.h.).....................!.1....A..Qaq...Ttu.6..."R..5...2B..S....bcs.Dd%&r3C...#$...Ue.............?..R...%.R...t.MQ*.l...v...V]..n...Zw....M....4..F.&&bb0.:]l......ay.r<..3.l.Q^.........I54.N2.8..2s...w..r6.......[1Zh....O...9..>...B......x]...r.\.\..v..~....y.QT.3.......=....r..}.l.....o;....M..C1....w)...+o1f.]...MoA.E..s5..i.\....miGsy..m\.Zj....I'YU.\tU6La5v.>.K..m.]1.......k..0....</5v.V7lY.e.vV.+./[....f..u{....s.}.Rb.Z.....Y.6]..m....V.\...Mr.=r...K...l..%..m^.......X.(..fG..[F*ly.jL.a4..vs..o.e..q.9km..w1.yg.....r_.*h.n..5i.-.{Y.l...<...'Or.s..Z....../JP.....\FV.S..............m

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001T.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12288
                                                                                                                                                              Entropy (8bit):4.576427515898853
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:/sYCDi2PX5F9Lg/eTLQdU5k+1Oomr+ZifH2bQX/UO/sOjRtAyGx/ep8kA9zBW:0E2PX5Hc/eXGU5lclr+ZiP2WzHRtcx/m
                                                                                                                                                              MD5:4DE915AAD2ABDAC2A5AE492C3532B4DE
                                                                                                                                                              SHA1:9247AB76C14EAD552CD904714DF8280A2422F4F8
                                                                                                                                                              SHA-256:6771448960001EF1EEF8F665FDAD7EDB5C7236D4154C0DB95C6500EE302CA287
                                                                                                                                                              SHA-512:8102A1A0108EEAA9B89920EAEB413B3250C56C491E5FED720738B16D1555BDE40087E15CC1BC8DD0203610AC1405164ECDE7D5411A76D5FE7FC99331E1D6CE89
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......,...v....... .. +..2...>.......|...v...H...@....*...........................................................................................................................................h..G....h..+......Cu.i_.I.......I.qk..B.....LZ.h..+......Cu.i_.h...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................6-...X./U......N...^.................<.m.sA.l.rZt..........V...x....................................I.qk..B.....LZ.................6-...X./U....................................h.......h.......h...........................................h.j.A...h.T.....h.......h...r...h.......h. .7...h.......h. .........Z4...........................................4../4......p...............C.a.l.i.b.r.i...................h...h...h...z...y.. x.. ...........$........4...!..7!..7................h.;.h...h...z...y.. x.. ...........$......

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001U.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):14177
                                                                                                                                                              Entropy (8bit):5.705782002886174
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:EbgGcV/hlvpfal7rgYa8S7auAxwfuSTmCSNoFQ6NO7L:EbgGcVnpwimnd38FdQL
                                                                                                                                                              MD5:7CDCE7EEBF795998DA6CAC11D363291C
                                                                                                                                                              SHA1:183B4CC25B50A80D3EC7CCE4BF445BCFBAA6F224
                                                                                                                                                              SHA-256:DE35AF949D4F83E97EE22F817AFE2531CC4B59FF9EE6026DCA7ECEBC5CF2737F
                                                                                                                                                              SHA-512:560FB15A9C12758D11BB40B742A6EAD755F15AD10D6C5DEBA67F7BC8A2AE67C860831914CBCBCDED9E6B2D1D5F26A636B9BCEF178151F70B4D027316F94F27E1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!.1..A....Qa".q..2.....&...B%6.'..R#3.$E.r457bS.DUFV.Wg(.......................1...3.Q..2Rr....s.4.!Aq.S.aC5B$%............?...n.Liq.}.{#....3/gg.1.M +..~3...q..+=..:.g.i1;P)7.....q..n.s"p...wx........v.t.f;..L/..~....y.r[.r.....n.n3..6i..g..}../........3..x.L.i?We..l.......~..<.;..6..o.....N.t.o6.l..~.......<...m.V...Q.7k.u./wq.t..;.I...}..{...>.L..3m..a....yd......6~.f..~Y..}+..<.[w..'-..?.v.7...v.u..4.......1];..u.MO.......s..p..ms.'.O-o...O......m.k.e....)t....i>..E|....,iOyD|.{......g.n...cu....=..........h.\.Q:?g/?.I.3._...t...d.n.0.%y....S.Q....S.&K.w..&wY<....%.g.v.....$y..#,i;.=...t...I6..yO..o.d..w\k...~......)..rK.......].u....N....e.s..kU.u..'}

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001V.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):49152
                                                                                                                                                              Entropy (8bit):4.643519902251599
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:1K7d8g3+XN0cN4uVsMwjkWZ/Hfud2MLSB02P18JK4vb91gQE8DXMRQmgshAQoxR9:1k9aNVWlXIBk5SnlKt3taXk6
                                                                                                                                                              MD5:8FD21D2416B4EB856E236D5E95E04712
                                                                                                                                                              SHA1:1933841DA1DD4EBABF1ECE08DBC0DA7AEEF24F48
                                                                                                                                                              SHA-256:84F0F013F75079E5FC9D103136D900F2A2E91D85FEB0A9939AE40E55E828023B
                                                                                                                                                              SHA-512:EBC073C1A3D71C9C4F8D886E15B48DF01B81233C43BD4248C68B1AFEE78B1B5EA252165ABC6A9B54C6F380AF5FE26D264EA0D4AE942C06EB24B01B6C6DFF963A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:v........&.......%..F&....... ..X@..@`..8.......v........%.......%..b&..x.... ..X@..@`..................................................................v........%.......%.......... ..X@..@`..X.......1.......1......K..v.z.B.............,LB......$...Y%)...^..._..........8.!\.....e.....y.........1W...y...........zAz.....zAz.................................................1..T.......T"...f..T%....{.T./.....T.....n3T.....<6T%...3.>T.B...........0...........e....4........................u.^s.Q.@.).~b.......(...@kO.....(..."...P.l.a.i.n. .a.n.d. .S.i.m.p.l.e...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.r...P.a.g.e.V.e.r.C.o.m.m.e.n.t...P.a.g.e.O.v.e.r.i.d.e...P.a.g.e.N.a.m.e...2...0.0.0.5.2...1.....0...U.n.t.i.t.l.e.d. .p.a.g.e..........n3......n3..;.L.........<6......<6...O......iv2.......N...........L.......2......._...f...dj..........D............Nr........1..c..,0...e...B4.$........{p.....G...^...?@kO...................O.{.....O.{L. vD..8.....Nr......Nr...d.G.~.)zh..e........x=1...Re...L...

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000020.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.3626413765302425
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:YspFNSeiiiE88mWXWW9dhCRAiZ0LZCKuhLZObE:YspSHe8sXb9LCRAW0FCKqFME
                                                                                                                                                              MD5:68E8C82AFA17A2F6476BCDCABCEC3864
                                                                                                                                                              SHA1:FFC306E0EC1E0982BE831DD83CF54FEE55030FF5
                                                                                                                                                              SHA-256:F22CE5838402527F0E05E106E7533782BFD5D99047C11C71ED40CAA85A69987D
                                                                                                                                                              SHA-512:5C126436857F5D4BC9CDA551D82CB95B8A4B60F0644D01A5E6BDF09B114E071DDD99830C0957DD2A9B08F9E1B4E0ED5BCE421BC0664DD6BF3A7FEFD2EA4FC9FE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZf#......f#....1..4...f#....1..4...f#...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............l.).o...;.....$....N...^...............V|4.W.wA.._.p..`........f........................................I.qk..B.....LZ............l.).o...;.....$........l.).o...;.....$.........f#......f#......f#..........................................f#.j....f#.T.]..f#......f#...B..f#.H....f#...B..f#...>.)f#...J...................;........4...4...4.."..............f#..f#..f#...z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4.........f#......f#.....#f#.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000021.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 814x105, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12654
                                                                                                                                                              Entropy (8bit):7.745439197485533
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:JheN2cq6MLu6MLGu54cHeNzhcmhcDu53eNE3UPkhrxvu:Ji2Wix7fzVsbE3Zm
                                                                                                                                                              MD5:4BCCCDBB4273ECEBE216C84930A8D0B2
                                                                                                                                                              SHA1:FFBF617787E27BC94D9BAF89F2FE34A2BD42794B
                                                                                                                                                              SHA-256:474F9A8C25D5E21192315397EA995B1E11E2C1608157C6E0277688091BFD136A
                                                                                                                                                              SHA-512:DAD73A8C0E293B88685C0C71EF15E0DC95EE39B7FC9F849DE5D634173FD9FA0AF0AA96742D9E94BE03556AA4A817D5001C95A6736EAD5D5DF03661876785EB74
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....C....................................................................C.......................................................................i..............................................E.....................U....V...f..ASTc.......de.1Qq...!Rb....Ca."r.................................B....................b....Ra.....!Qc.....AS.1U.."C...2Bq...$#3%&.............?......3.....~......:..g..s"......:..g..s"..ic..Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. ..0...Q_..X..V5E~..c..X...@u...cTW...0...Q_..;.m.....@w...Q.+....*.4W...lUFh....v..._..wn...dW....y._..v..E~...*...@wn...dW....y._...v..U..@wn...d..{`;.|U.2g...*.3...:.0?ViN.z.@w...4.M.:m..`~..i7...q...I....J.`l...W..n..PQTiB...6....+..sj.*."...6....+..WA...x..A........(.N6`..AD.q.....'S...t.Q:.l.......f.]..N..0.. .u8..A........_W..Y...}.C...~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~.v..?U..^.r..}..Bep

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000022.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.350014074305796
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:HwskJoRh6Wat4/aEp8fXMJ9VNcUsrdhSrHAttXuc9Idlm/V:HwstIDXEpSXA9VNIRAsIdls
                                                                                                                                                              MD5:EE2D48F5E19ED39E1D228C317E7A03AD
                                                                                                                                                              SHA1:14B14AAE91A5DB93630CC425A1D884D415FCE1D6
                                                                                                                                                              SHA-256:64930F62419DA1C7813E5C3CED985898D0B7ABAD5630CD969243077FD115E33C
                                                                                                                                                              SHA-512:8ECDD81A03444BEC29C63E74D898171315FAFFBE18489CD73D37577238B1389DCFA0C9B7F65138342C37541501437554593F86207E0925664FC7B9F017BE9100
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.<.......<.+.T../...#f..<.+.T../...#f..<...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............S....&......RRW....N...^......................A. lc-vt.........f........................................I.qk..B.....LZ............S....&......RRW........S....&......RRW..........<.......<.......<...........................................<.j.....<.T.]...<.......<...B...<.H.....<...B...<...>.).<...J...................;........4...4...4.."...............<...<...<...z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4..........<.......<.....#.<.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000023.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 728x77, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2695
                                                                                                                                                              Entropy (8bit):7.434963358385164
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:N9YMsguOZgKAz2vcaQU4R8r4BU0/Rc4nbIQdsohw13ZmFLY6KsVvMdBL2mr:/hsEgNz2v5T/rQC67SoWniHK4EdBH
                                                                                                                                                              MD5:B23DE98D5B4AFC269ED7EBFDDECE9716
                                                                                                                                                              SHA1:10AF507A8079293A9AE0E3B96CF63A949B4588AA
                                                                                                                                                              SHA-256:646586CB71742A2369A529876B41AF6A472C35CC508D1AE5D8395D55784814F2
                                                                                                                                                              SHA-512:BBACBE205EC0A4F4E3AB7E2B1DEE36FCF087DDF77C7D18B53AEA4B15984A47C64E19F9B8D8FA568620619CEA0361D94FE7ABEA6E502EC6ECAEFE957F42ED7EE8
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......M....".......................................,.......................1....!ABQRq.2a."CbS.......................................................Qa1A............?....{............i........l..-D.q.~..|cS.S...R\..d.8,!.....]f$....Q..di.;~5......vj......MqCe..=.*.f^..=.}.Cm]qCd..s=..u.e..v..t'.,.....S.s..N...>.d4'.,..k...N...d..9....G...y....6J.Y.l.{Vf...^B..i.3.z....:5W#4@.S\fj.%..Mb.5.v.5......S.E..#.v.I.....I......m..H....D..|.Y|...W.Wf..o..U.0.E..@.T.....................................'.S../...Z......!J..1K..rI...T.f.>.+.N..o.....\..^u........e..q.qK.GXP..-...F8".;5J...]Y......j.a.,R.......J.N........z}<qu..J.)`.}X:..}.............B...[. ......,B.).b.......(Y.O....c\.o.e&.W.#Bo..N|..N8.#J.>1D.1..b.&....q.#..UT%,.d.....m&..^...VXA..b.nbTV~.....^........q..#./.I..=Q..=..Y.*.Ib...VZ+......Y.........'.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000024.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.360151236261483
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:JKBsktgbU6Bt/Dx6huE/E6Z0Xkc6+D09B9crlrdhSrzcJFl0tXmTw/9TkkF:MspQM9xzE/viXtpY9B9alRAYJFitSk
                                                                                                                                                              MD5:270F88AE8411654CA6DC4E8F2ED43CE5
                                                                                                                                                              SHA1:9D8D6CF746F55E9968EB296FE2C7233B01955CD7
                                                                                                                                                              SHA-256:9AE4683813AE2B07245A6E3D129A4632D56217050A8A2CA1147D1D8816B960D6
                                                                                                                                                              SHA-512:83148D70BB24F77E74005A5C566F0C7EDC6EAB99354FE86F91347C22D4D4D0C7563E2D7F861331CEDAB8F4B73CF7C9FC2DA4C0F6CD32418CBEA5F73CA5C4F38F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ..5.......5l...=.@. /88..5l...=.@. /88..5..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................ou......5X....N...^..................G...J.g...L3h........f........................................I.qk..B.....LZ...............ou......5X...........ou......5X...........5.......5.......5...........................................5j......5T.]....5.......5..B....5H......5..B....5..>.)..5..J...................;........4...4...4.."................5...5...5..z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4...........5.......5....#..5............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000025.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 69x630, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):11040
                                                                                                                                                              Entropy (8bit):7.929583162638891
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:u99+91V42ho91V42ho91V42ho91V4235z9pUkDCyixxo4PS6b8tEy3BcWWhhSy0b:ubKD4/D4/D4/D4uzX38u4PNYJ2zhhmb
                                                                                                                                                              MD5:02775A1E41CF53AC771D820003903913
                                                                                                                                                              SHA1:2951A94A05ECF65E86D44C3C663B9B44BAD2BC9D
                                                                                                                                                              SHA-256:83245F217DEAE4A4143B565E13C045DBB32A9063E8C6B2E43BB15CD76C5F9219
                                                                                                                                                              SHA-512:5A1FCC24BDD5EE16BC2C9BACF45BCECF35ED895EAC22D2C4EE99C1B7E79C8E8B9E5186E3D026BA08FF70E08113F0A88FBF5E61C57AF4F3EA9BA80CE9F33410E9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....C....................................................................C.......................................................................v.E.............................................S..........................Aa..!12Qqw.....3568rv........".....4Btu.....#Rs.(W..bg.................................D.....................1..2.!4Aqrs....Qa......t..."3BRb....#.$S.Cc..............?...K/h._+.N6.-.a...5...;.r....,...0B.s(..zp..4.%r|q..E.Q^.../...C.R..?u.q8XN.>.e..:..gJ...._.n>.70G,..(........3b.&.5m...Q../...7Ie..k....e.l6..&..`Gt.P.Y^r...=..Y.e...N.B...O.#..J+........u.V;G.'.....V.]8..C.]..........E.....c..w&lX..f..\T.J?...F.,..m|..93........,.....+.R..WG...%.....(@.....p].iEz<.8.^...J.h.....a8P.1......(z..y~.........H.Z^.>..<.....L.k..IG...R.(.%..m....&u...B|.....@]ey.W.J...!d..R.8...[..>8....(.G......!.)X.....,'..F2.Z.t..Aw./..Z..#..i.kK.......b.i...qR.(....RE.............O.XP.#..(...9J..]...,.2.[w....KrW'...tY.......{~.:.+..

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000026.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.473223892777621
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:KsWwVzZ0YYi1SK1tUEP3F7DXO9FA5rcbrdHrjOtX9Cz5+4ZSn4eazep6zyNn:KsAioK1WEP3FHXO9F0rKRLK+tk6eQO
                                                                                                                                                              MD5:2B3811BF72E22C5144B13646EE9A8104
                                                                                                                                                              SHA1:E2A89BE48FE03C5F7690D893AECAFFBB33C07311
                                                                                                                                                              SHA-256:922B1089E4F771200C364E0132D5BFBBE7FA9C17592E40EF42459FC54600E429
                                                                                                                                                              SHA-512:9959CEB14B2FAC9B0739D720044F21E89A9FDF25A36EE2BD28ED58E3F1FC434CE6C5E7C498B94E51CC351E3CE184D8015708ED8237AFB3A3D18CC2DD7C9BDA1D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......p...v...d.....................................................?....?........................................................................2...>...L.......v................................I.......I.qk..B.....LZ.]p......]p..p..7. .....]p..p..7. .....]p..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............*.*N......A.....N...^................j..G.E.9+.1!>.........Z................................... ....I.qk..B.....LZ..............*.*N......A...........*.*N......A...........]p......]p......]p..........................................]pj.....]pT%c...]p......]p..G...]p..H...]p..>...]p......]p .3...................;........4...4...4.."...............]p..]p..]p..z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4..........]p......]p....#.]p............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000027.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 105x441, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2268
                                                                                                                                                              Entropy (8bit):7.384274251000273
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:N9YMn9H5gXlM26vroVXWxyNnl1LmLR+rn4FOeewGhDbby:/h9SlMdgm09ll8R2/rby
                                                                                                                                                              MD5:09A7AE94AA8E517298A9618A13D6E0E2
                                                                                                                                                              SHA1:FA5181A7414BA32F816BF0C4278EC20C615E8B1A
                                                                                                                                                              SHA-256:3C68C7EE798E62A4A99C740153F3980D7DF029605C843410942C7F85E794823B
                                                                                                                                                              SHA-512:074E9A2BE2039D0AFEAD360157550B934FABD0CB86B5AF476C1FBC885EE60331F5A68EAF70BF76E23C8248A20FB900346839F4AA8892370B5889E64948DCC6E2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........i..".......................................3......................!.A..1Q."q.2BRa.b...#$................................... .......................!12AqQ.............?..D.z.4....;.....7...3.t<!..d.O.....+O+.;.z6.4cz7E.........U.Z)-..@..y...........}(W...<.xv/...5.ew......yN....n.Tk.Tm.Ty.vA=...T..U....h...e.8.5%....'......e^......L.g.$.~e..O.._...... .F`.....xnL.<.......]jfv...}..\G..c.......-%...#.C.|.].`..^..W..c..B..5D.QSTaZ.5A=....BU..z%.4.h.6..=..U...W.$..l...7.:...........IPQT_...~..i..x....~.l.|.n.J..TV.21.Tg.....................j.z!+.-............"j.j...)*..TT...."....T.Tc.**j..............j.z!*.h...&.&.&..e.%..TksTW%G.?".l+$..c._9..[x...TU..........i~X..#'.qm?ttO.....}*.i...q.....9..r..?..W..d.w...f;..q...tZh..0.....2.......OD%Q-.......$......56.K.O...y._..*_C.k..p9.p..O..vu...'........0v

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000028.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 76x97, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):784
                                                                                                                                                              Entropy (8bit):6.962539208465222
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:869YM8fij0W/xfuCp7ovv1bidiMn3bGi6AETQcdH8SADjoZgV6v9jUEvS3/g:N9YMWeI424diMn3yinsQeHvADu9QEvJ
                                                                                                                                                              MD5:14105A831FE32590E52C2E2E41879624
                                                                                                                                                              SHA1:078FA63FC7DB5830E9059DF02D56882240429D90
                                                                                                                                                              SHA-256:D0A3A1C3CD63C4023FE5716CBE2C211307D0E277E444D9EF76C7FC097A845FD4
                                                                                                                                                              SHA-512:8FC0ED24E8EC14C46EA523D9265DE28F85C5FC57AA54AD5B9CA162E95F79221E2AD3DD67D1293CF756B67F3D3DECAE122254134EA8D4D00DDED02114B5383947
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......a.L..".......................................-........................!A."1.Qbq....2Ba.........................................................1............?.....3.Ty\......vs....>.>..a.W..s89.d...Z}......rz...`...Z.r.do....u.W.%....gf.>.L..xz....B8=w...g.~g."HD...$..IKJ......nn..*ly..I....L...\q...Q;6.KrxZ.,...j$..ZQ..)f...q`.*..C1..cZ2]-..\.~..J.....^..(.f..9m?..C.NI.UL..X.fy.Z.........+n....r."Z...d..R./\.#...kd.D.5.!...h.3*s-+.......Xjt..}i..rK..y.../>u..]N.....Y..J......1.x./.....F6.......I...._3...k.sM.+..v;.%|.f.~.......:y....S....UKovh...W'........lF... .................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000029.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):2.7303731014796346
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:FshnaRo0SZBbkFbvMBNyTtUEwsUqXQq9J4d2NP7rdQVr5w0tXebLtNh:FsFeDSZVkBvRWExzXH9+d2V7RQ5tWj
                                                                                                                                                              MD5:7F1CF47D0AE69956C96138391C0B770F
                                                                                                                                                              SHA1:90B6261F050B44FE5E9891638D796C38C0672241
                                                                                                                                                              SHA-256:177F420C8584F7F22CF8A1F80B48D4C0A93AF64A467D67EC6CD70C77EF116AAE
                                                                                                                                                              SHA-512:D46722A4FEEBD29EE325845BF95C66C4DD234CB58E062E0A7E805CEB66CAAD3444439396CA389E5D251609306C7FC77E17CDBA6E33D3C83AAC2DDC7A8EB7FDD0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>...........v.......................................................................................................................................2...>...........v................................I.......I.qk..B.....LZ.d.......d...N....o.q-6..d...N....o.q-6..d...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............8...'=#..@..:E.....N...^..............._.9...C..'..G.a............................................^....I.qk..B.....LZ............8...'=#..@..:E.........8...'=#..@..:E...........d.......d.......d...........................................d.j.....d.T.l...d.......d...Q...d...Q...d...>...d.......d. .3...................;........4...4...4.."...............d...d...d...z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4..........d.......d.....#.d.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002A.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 95x498, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3009
                                                                                                                                                              Entropy (8bit):7.493528353751471
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:aRCTf+0hagMrbAZMJShPdvF/5OzlQFlDF7npkDdWvVBTEnBLT6NrgCX0:D+0YgMrApL553JtEdEVcL2NcX
                                                                                                                                                              MD5:D9BD80D40B458EDB2A318F639561579A
                                                                                                                                                              SHA1:83BA01519F3C7C1525C2EA4C2D9B40F28B2F2E5E
                                                                                                                                                              SHA-256:509A6945FACFB3DDC7BE6EE8B82797AD0C72DB5755486EE878125A959CC09B59
                                                                                                                                                              SHA-512:C368499667028180A922DD015980C29865AEF4A890C83E87AE29F6A27DC323DD729E6FB1C34A2168A148E6A7A972F65A5FC8ACE6981AF1D4E7057D99681CB366
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....C....................................... ! ..''**''555556666666666...C......................&.....&,$ $,(+&&&+(//,,//666666666666666........_.........................................:.......................r.!12BQ...3Aaq.."CRb.....#4$c.S.....................................................1A............?..p..-.....u0$.......l......)..o.FTd..DG....... .t*e..jO..Z.U......r..j.O.,..VD./.....V5D.&......A..Zi....E.N....*..........#..M<|.2.Y.../QO.x.cTM4......+.F;V.x.de*....]e..O.x.c\Y........r..j.O.,..T...hw..k.^.[B..J.sEl.w.x.m.5%zzt0..T.......b..<\.3Q..W</..!.xh6..Z..\.+M.o.Y..1............#.........|.a.l.KR>..U......e....@...\.1Z...Y...[....F.6.t.#..Z,.x.Q..[`.X......#........W</..TM..-H...V....Tf..........r..j.x.df.f.....#..l.KR>..U......e....@...\.1Z...Y..Y.us....D.)....Uh....FkYm.m`P...W .V.g..FjVj.\..1Q6.t.#..Z,.x.Q..[`.X......#........W</..TM..-H...V....Tf..........r..j.x.df.f.....#..l.KR>..U......e....@...\.1Z...Y..Y.us....D.)....

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002B.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 700x114, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2266
                                                                                                                                                              Entropy (8bit):5.563021222358941
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:TuRCTP9rSTfIEe1HbcVY1YbDXq8eCI0bf2QQe0GVDQAzZw:aRCTN7HbcW1YbDXq+I07Ien0AVw
                                                                                                                                                              MD5:DB8A181E3F0EAD4A9472099E42ED6BE3
                                                                                                                                                              SHA1:92096AF05CC6167B1AA816811A1160B809393FA2
                                                                                                                                                              SHA-256:E9746B4E9AE9CE7B3B0068779DB3E113E2DFC9880F25373D745D0E700E69A906
                                                                                                                                                              SHA-512:A9E246E10E28D057090BA9F034ECE6131780D7F794C5C9421523388997C7EDFBB49BC32B863B6C6668911B359C304AA54969B48CB9234950D5CECD2A6F3EFFF8
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....C....................................... ! ..''**''555556666666666...C......................&.....&,$ $,(+&&&+(//,,//666666666666666......r...........................................5.......................!1AQ..2a...."Rq..#3BSr..C..................................................................?...X.....U...j...F.W.V]'KV.uWt.iT...{.......`.(.....V%..=.....z......V..ct+.U.B...@.............................................{.....5.........0...x4....c..;...........+......|.7E.%.9.1+}..d.........+.V#.P.HUL.E...g.li...8.>U.";0pi.]5.\..zo..."@.........................................y.6.mLN..S.....@...i..A..p.......~|V9.+.Xy.........+,L.....7Z7..p...-X...\.....:-...i....v.1...-..H....9.zk....l....^.......:.."^.t.Q.F...X..B..$............................................a.%f&3..1.5+.X..'b7bwr.).e.x....!...H...aa_..kD...b..g..p..K^.k..qX.[,.........Q...U..x...YMvj...w..:k.....j.W.8..4....c.u.}m.....o.=@.......j.S.t.|.....5h.y.%.~...G

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002C.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.302475355813159
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:YVsgJmjjGWE2XI9e/8RQyoo4LRW74Nrp:msgcjq2XI9e/8RJoo4tW74Jp
                                                                                                                                                              MD5:FCD43CAFBAE1317C6A122271A2EEF065
                                                                                                                                                              SHA1:5128116DA7DE4992347113B0EA60045D7F77083A
                                                                                                                                                              SHA-256:420895E4C924B67A7897227882349B92D8CBDDC07F479A2D34FB5CC36CA3539D
                                                                                                                                                              SHA-512:3756B4228A77AC07BEC2C644579BC8881606E09A07D77A97334D0203425F5E9E48DA2252C9707B5FBDE37DB195FE8456F73C860ADA67B161EE865BB6E71C1198
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZE.q.....E.q...O.....2'..E.q...O.....2'..E.q..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............W..>L?..1.|8.......N...^.................h..v.N.(.'ILf.........f........................................I.qk..B.....LZ............W..>L?..1.|8...........W..>L?..1.|8............E.q.....E.q.....E.q.........................................E.qj....E.qT.]..E.q.....E.q..B..E.qH....E.q..B..E.q..>.)E.q..J...................;........4...4...4.."..............E.q.E.q.E.q..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........E.q.....E.q....#E.q............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002D.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 813 x 99, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):99293
                                                                                                                                                              Entropy (8bit):7.9690121496708555
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:Moq1jVORV5NO5xLCBaaNk4vhpCr1CH/DATOQlWvHMHojiaAMrxArLFRZPj19AWFz:eVEbouBaIk4T8uDGOQlVHvaAMkhDh95V
                                                                                                                                                              MD5:EA45266A770EEA27A24A5BB3BE688B14
                                                                                                                                                              SHA1:9F0B23B3C8EBA4FC3C521E875EF876FBE018F3C8
                                                                                                                                                              SHA-256:EDAD0F03E6FF99FEF9EF8E8B834CE74F26CD23C5F8C067F5CEE66F304181E64D
                                                                                                                                                              SHA-512:D4EE36BDA897BBD643A699A0332DD00DE9CDCC6F46D861789BAD259A4BF87868AE3B4CFAAB6DFAF29941C7055B77A95D76BAA86A4A0DB2BF3BAF7E3317F03EB9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...-...c............sBIT....|.d.....pHYs...........~.....tEXtSoftware.Macromedia Fireworks 8.h.x....tEXtCreation Time.05/15/06.8.p....prVWx..[Oh\E...y3kv........`.%m.R..6.1.4).o..Ki...D.......P!.].=..K...C[....f.}o7VPJIg...{3.|....d.....i..=.4.u0...n y......@j..Q..f)..mQ...4-SJ..9.d.?..5\-....:b.W..i...c.5..{..pj#.....B1C/.I.......].Su.k?.2..:.9Q...5.U...UZ...e..U.c],..2.}...1..)W./..Epr.Zt.....K.=..{......e..."...v..B.4.#....A.V1.".V}t..[..2f..Y..V9.".6.......(..gbm.P.....Y%2.c.z.:Q.2.<tYF.....u.@..KJ.;u.q:.].....$.....V....Hqk..DW.l.e.j.Z.YP?:'R..*.<........6...m@..r..j2..HK"|..L.Nc..D..y.9..B4$.......`.3.m1LE....7(OU\+./.O...%6T..w......h....).I.&n...*......#..W.41...5.#.`..I...<.?.|..*+Q.....#i........$,..n...`.s....[..E. T.w..j.,&-.r..;a....#.>(.P......f...MU\3*..;B....)..5....z..(....-...a.....}y.l..E...z>......&..g.$.....*T...N....E:./.>..#...^..E.0..%......(..@..W.X.NDM.<~.]A.>..fW.O.y.'...Z...h..).F..

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002E.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.315793095888774
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:YuqsrSYDdvQtCfEVpygX1pmP9WTotrdQqrOI2BXr6C4cekc6h:YtszdvQ6EPnX1sP9WTsRQyJ2Q6i6
                                                                                                                                                              MD5:108DFA5F6487CDB4851A79B1392546F0
                                                                                                                                                              SHA1:3A12AA61C03D33B3A16F2F032EB51A1998848ABA
                                                                                                                                                              SHA-256:0F7A19AE95D85F0A7334D958DC4A2A39F2B7B312C01260FC2E587FF8634BDEC7
                                                                                                                                                              SHA-512:9B1F9F542FFE111E7D567E711BCED19C75B4EE617D244A8336EAE6C0A03B896FD4091B51E842B9BA11C6EB8B07E57B514924815BD0D02E30F204EBA7832778A3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ._O......_O*.N.....<V.|.._O*.N.....<V.|.._O..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............yK89.....B.W.k.....N...^...............o@.)k.N....pR..........f........................................I.qk..B.....LZ.............yK89.....B.W.k..........yK89.....B.W.k..........._O......_O......_O.........................................._Oj....._OT.]..._O......_O..B..._OH....._O..B..._O..>.)._O..J...................;........4...4...4.."..............._O.._O.._O..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........._O......_O....#._O............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002F.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 780x107, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2898
                                                                                                                                                              Entropy (8bit):7.551512280854713
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:N9YMTXc4gpw+EIWnqQ5G+NE9VTzRFvS4+Xh+AKrNx+JuCluc3Eeky8etajhDCFex:/hDc4rPIoNEzbS4+XhOrGJu1cUHeoVey
                                                                                                                                                              MD5:7C7D9922101488124D2E4666709198AC
                                                                                                                                                              SHA1:00CC44A1B84D4D94A0ACE8834491EB5F65D04619
                                                                                                                                                              SHA-256:20016E5FA1A32DCE5AF4E92872597E36432185A7BB2E61C91F362BD68484529B
                                                                                                                                                              SHA-512:882944B2CF040485899128E03B7499C540D481E45FE8017DBF4FE0330157B2D8ABB7334DDB31C112BA0EFE3722A554883917C54155A7F60044D2D7F3D848260F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......k....".......................................2...........................c.....TUb...Sa...QRqr..............................!.....................Q...R..!..............?...$.)m.1...%%bV.J..H....-.%a[...I"WJ..:.X.:TT.$.......N.-NR.E..-NR.E...9..E....$.k.....B.I,I)..J...kr..+)..I,Yj..YbI..+,J..e..Z..V.e.$V..TV.X..V.YQZ.EQ..U%PY[.[.R.EP............................| F.. ...j*...!m.!j.I%.j.$...YeEYYEEUE..eY[.hEEUeEil.....%..el...V..TUYA.U.UTTUT.Z..UQQUQE...V.,...UlE.U[.lEP.P.@......................................R1...AR1m.....#..$:.T.p..IJ.t.....A..AH.,5..]F!a.XJFaa. ..a.!*.aa. X.e.......bB.b..,HX[,!..,,.c0.,..U..X..(,,...B(.,..4..B.`..".a..-......"...........................>D..IKEb...t.....)u.....)K.%+L\.J]i)*b.JR.IIL\i)u....T............T.....qs.it.iJ...])ZJb.....X....U.A...V1..B.R1....X...,.c...,%X...,%#0...,H

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002G.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.323599945625522
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:6NsvrgsrOIl4EShsXQWB9HkRQyRV3HgUTu279TM:6NsprOcfX/B9HkRJRV3
                                                                                                                                                              MD5:4B9C3E72D8F8CAD6036F44E005C1E74E
                                                                                                                                                              SHA1:F28ED31959356ED46B0F632986F0C81392E73F16
                                                                                                                                                              SHA-256:4C7C834CB4D33CC492F13122FF646ED50799F83D9BA6FF00720D2FAD0950A8E5
                                                                                                                                                              SHA-512:9AADF891537DDB53A34F0154B37F1199650627BFE537FB363B0D28FC97E1AABD6C0C01C7118504FF2462B77457265AD92CB6D984ED47A92EE922C6FD6E34B7EA
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|...........................4.......4...}.%....8.I.......I.qk..B.....LZ4...}.%....84....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............k.."@r..2.i.tQ.....N...^.................]9.=.E..E9..........f........................................I.qk..B.....LZ............k.."@r..2.i.tQ.........k.."@r..2.i.tQ..........4.......4.......4...........................................4..j....4..T.]..4.......4....B..4..H....4....B..4....>.)4....J...................;........4...4...4.."..............4...4...4....z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........4.......4......#4..............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002H.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 613x144, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):29187
                                                                                                                                                              Entropy (8bit):7.971308326749753
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:RwjBOlCk+nYnGagKJWJhwMJiRO22ZIm4VXvXx1tA6BQs:i8snY3JW7uROlEfbtVL
                                                                                                                                                              MD5:DF99CAAAB9A7DE97B63343E60A699AB6
                                                                                                                                                              SHA1:B84334135CFB73BC6EF55F85926770D5AC6DFEA8
                                                                                                                                                              SHA-256:74C131777E7C437FD654427417097BC01B0813BA8E1E50E4B937BD50A1BEBCDB
                                                                                                                                                              SHA-512:5D15AAAA8B71DDFE01A7C0ADE16D9E1F5E9AAE484BCD711B38CCB103ED9564CAAC23A0031471167B660E15972D70179C2A387509B213C05D60261042A0456025
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....C....................................................................C.........................................................................e..............................................`.............................!1Qq...2ARa..."#.....3BSbr...$4C...Tcs......%&DUd...E....56Fe....................................H........................!1Qa..Aq..."b....2R...BSr..#...3..Cc....$%4...............?...b.d.8T1.;#.S.DO...~.R.......3.xe...z.6..."m..k...;*.'.f.5^.....m..<$....8.R.j.D.v..>...*dT..vGbt...I......sEWp.r3.. ..G...6.....w...l.S..q...b.....-R....^Zu5+u6...A..Z].:...5..Uzn.,l.L.....?%.*.S.+zVg7.=.s.Q.....8..:,c.......ZE...>'IF..W.0.d.......c.e.d.V.t..S$.DNR.[....g..#i.$. .U.SK2.....k...J5u u\R.....T.[4..A.O..,.T..................] .i...B.m.^f....._...{S.....<......:..|D...+...NA....Y.^f.1|..%K~1..B..^...S..v=.c..g.tX[..kTJ..t.gr....R..@.F....5j..2.K.9..g.1N.....*.U...^w......>+.l.v...@N....%Qd...t.Ni.....0;lggm...K".+!.,.....[J...>..?f.]._;

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002I.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.343860804989015
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:MschXrlu1ByS+tAaW9EYYOt7KdXz81p92/oprdQqrERBXBI9THV:MsIr81ByS+qaGEYY6qXwp9MARQyoO
                                                                                                                                                              MD5:F25C90B4E8F41CF38D513AB459FD316F
                                                                                                                                                              SHA1:4F7BF670775852646969289315A50E1BBFD639EE
                                                                                                                                                              SHA-256:315AEC5DEA9AF44D29BD61E1881AD8487E4A5BD3BA2F751664C1610CD10346ED
                                                                                                                                                              SHA-512:12AF5825902913E746E6467381B5B3CB5D806443EB309935AA6CC93295E46DDCD50CE4B7ED7A3C3EBD339FEACCA13AEC5578F2D33DAFC2B5AC0A2FD8999C5BBE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZp.V.....p.V.Q`....|...Cp.V.Q`....|...Cp.V..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............|NX..m.<.;.......N...^...............(4.s.~@.p.,..Q6........f........................................I.qk..B.....LZ.............|NX..m.<.;............|NX..m.<.;............p.V.....p.V.....p.V.........................................p.Vj....p.VT.]..p.V.....p.V..B..p.VH....p.V..B..p.V..>.)p.V..J...................;........4...4...4.."..............p.V.p.V.p.V..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........p.V.....p.V....#p.V............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002J.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 276x139, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4819
                                                                                                                                                              Entropy (8bit):7.874649683222419
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:/hnQiz+ET2/hDi+tv34VtpWfowTHgegb6hhLT1NTS:5nQ6TAhLtvIzMvbi6hhF0
                                                                                                                                                              MD5:5D6C1F361BC04403555BE945E28E53FC
                                                                                                                                                              SHA1:00C254F7B3BC0289590C2BBDBB39C8EC2E2B2821
                                                                                                                                                              SHA-256:131D637CDC5D0B094FB9FAD17F4D2A1ACE0D03613588155AACAA2D1CB4E16DA9
                                                                                                                                                              SHA-512:34D2C0929FCC3CC10D0A2121BD55BFA9A07062C2A7B8F101071164C946895DBCB2777641E79DE4193D57A3F0778DD4F1351FAF333B7E4B4DBE31A32DD69C51F9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222...........".......................................<........................!1..AQaq"...2B...#Rb..r..$3CS.cs..................................................!1A............?.............u....p.p($.Y...9,j...V.*..S86yh.G.#m.5..9...6Y.."C.R:.[..-.7U3c:..].;.....f.?%..<T...&F.Lh.N...m]..x.D.g<B.....k..S........>j.K....#U..Z....<e.:..8....o..xq.[..4v..U..y...k... k....A#..A...pn.jJ.I.7:..{.b..ns.t,...8.Td.I....m.I.5Z.).-.. ]..X.Do%.....?..4jV.`llt.E...5...u.|..\F.=.F.r<...5dV....xc.%..&...4,...f...3..H.<......eQ...P.J....7...lLc..?..-.fR..7.#.6.......}:.]'.ny..........e;u.Y..$0...i..-....f..9(....}..T,.Inb...+=Cca7....WULA1@.s...4uY5.N.f.c..].ks.....3v..~..k..m)...f gNE`S......#.....Z..6.uc.m...#k.s.f*.l.$6..?..xC.Cm.`...N2..&H...._.&.E...[....f.Z./...!.a{K..#.V.5..v.B....1...9..B.&....%s.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002K.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.370757591306901
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:ysL5f4WzamtFWqzsenEnV5NqCXQnRC9WxoBrdQqrejnhBXX4Yk9/sngc4:ysh9zamvREVLqCXWC9WoRQyyiYQ2gc
                                                                                                                                                              MD5:2EEC5A4E3CC311C6BEFF588508C9F454
                                                                                                                                                              SHA1:52F1C27B4BE695C8539F2DE6791E675CDF5F3511
                                                                                                                                                              SHA-256:93FDD4D0319399CCE4C7F2BE41EC8496462309524FC5FCE4338A60E940FA21D7
                                                                                                                                                              SHA-512:1D90DF08AE7E76D76E730FF725AB3277BBD84CD059DA8CABE9B2FE2E84B322F006ED97C78F76A10A755E6FF31397C0FE9D9C422C0F24ADA819AF42DDE338DFD0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......V...v...J...................................................................................................................................2...>...2.......v...~............................I.......I.qk..B.....LZ............9X............9X.............I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............N...6........F.....N...^................./....L.U..............f........................................I.qk..B.....LZ............N...6........F.........N...6........F.........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002L.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 814x45, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1717
                                                                                                                                                              Entropy (8bit):7.154087739587035
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:N9YMzO6BOfqH/dAIWpdAIWpdAIWpdAIWUtr/SD:/hzJgfqHaPYPYPYPUt/i
                                                                                                                                                              MD5:943371B39CA847674998535110462220
                                                                                                                                                              SHA1:5CA79B7BD7E0E93271463FAEF3280F1644CBA073
                                                                                                                                                              SHA-256:9C552717E8D5079BBB226948641FF13532DF3D7BE434C6CE545F1692FA57D45A
                                                                                                                                                              SHA-512:812541836C8B6F356A4D530E5CCF1CFDCC4CA54AF048CAC19FE86707CE5EA0F41D73C501821AC627AD330291EF58C040DFC017923A7886CEEC308048DA2CE7C9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......-...."........................................&.....................U.....1T..S.R.Q.................................................R....Q.a............?..d.. ...............................................+A...Z+E...V+E...U..R.....}........Q..Ah....Ah..b.AX..b.PZ+A...V+E...V..J*....Q...b.Q..Ah....Ah..b.Ah..b.PZ*.(.@z.?.`;2.......................................................Q...b.Q..EZ*.(..Z>.G.....`Z+E......J*....F+D...F+E.......b.Q...h....PZ+E...V+E......J*....F+D...F+E..............[u#...a-...f<.9^[...l0..H..6.Kn.t...&..3a...GG...[u#..8.y6.q..%.R:8....6a.+.3..a-....l0..H..9^M..f..m..3a...GM.q..m..6.Kn.tq..%.R:l.W.lg...[u#...a-...f.r..c8.....f..m..0.....l0..H..6.Kn.t...&..3a...GG...[u#..8.y6.q..%.R:8....6a.+.3..a-....l0..H..9^M..f..m..3a...GM.q..m..6.Kn.tq..%.R:l.W.lg...[u#...a-...f.r..c8.....f..m.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002M.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.365552212164579
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:g9zswOaHjeElq5cgntz+EKd79JXckB9CoEVQoBrdQqrJ7ypBXGoajGloKMszlIg:g9zs7V5cUsEKd5JXjB9NIRQy8pPlI
                                                                                                                                                              MD5:728197D5F297BA325D4219BC7FA49984
                                                                                                                                                              SHA1:EA91A1BD3A63A73AFD1139DCEB5AAC9B325B531B
                                                                                                                                                              SHA-256:6DE7EC83945782BA6ADA9E397D80F76995BF83150C2D42916E7DB5695D1A885B
                                                                                                                                                              SHA-512:8A0034D49B771DF29D2B2F3DCACED675D93DA80A2195B0A611EE99C4928D433D1C48A42F768A3BF608903E0B8A2CC370A36AAF94D6C6F7668F65DFAE9AE819B9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|.......................................B...@.[..I.......I.qk..B.....LZ.....B...@.[.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............H.....0....hg....N...^...............S%.q}t&O..z..}........f........................................I.qk..B.....LZ..............H.....0....hg..........H.....0....hg....................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4......................#..............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002N.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 262x277, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3555
                                                                                                                                                              Entropy (8bit):7.686253071499049
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:/h3JeYCQV5Hn++9HBdAjU78S/mjLLwqnqahJD:53Je8b+EBdAjm8S/mjLLRnphJD
                                                                                                                                                              MD5:8A5444524F467A45A5A10245F89C855A
                                                                                                                                                              SHA1:ACE68D567B02B68275E0345C86DB1139C0EC1386
                                                                                                                                                              SHA-256:7D2B01F17354D9237A6AB99D5B9AFDF0E1CC43687125848B0C2DEDFB44CE3843
                                                                                                                                                              SHA-512:8151B447B60D110C32EC1EF286B941FFC09B99140F41BBACF5A1650A385FF4D13C0DDB2878E9A470FC7CFCC95A1AB6E44F6DE72562B0FFE093DC8A3C3C7FCC14
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222...........".......................................2........................!1AQ.a."2q.B..#R...3C................................ .......................!1.AQBq............?........)&vD.)3Hn*..X+....r...tmL.k..(.E...R. .Z..&...,fJ...!...6..S\t3.=...g&..Bqe.)_U.....1......-..fl.................J...u.i.mU..K..v.w.0O..E.h..D~K.(..9.,8..E.}.............i.\.....t."v..q..C............<..|3.........................*Q..../c.....f.}8....D..|k..Z......0..~..c..e..m(...|.c..'.5.5............==bx.5x.8...T;....=.--.pc...I;.V.m..,(....}...NH.ho....Q..U.E$.~...w.t>.S\....'f.{.+.g._.t....;>.....P...........-..G.h..2...J.% !.E97Ir.D..N....j...oE._...._...".?.......#".S.........Q.Tc.I..*I..k.......=$.........sk1Jp.\K.....F.3.Q..q..J....N..[l.&....OR4bB|..2ul....J...B.$&H..9#j.f.n./........?R~....B.I.@..........m

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002O.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.3345935389747705
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:csJImZgbIfeEDXKp9W+ZRQyE2lpim1397A:csRgbUDX89W+ZRJvf
                                                                                                                                                              MD5:76034FE999FBF328409898788D44E459
                                                                                                                                                              SHA1:17D25C15D098C8DA0DF4F2C4C43AC9EF50FF8175
                                                                                                                                                              SHA-256:84A6AC2454A81EA7D35D3925B8C40B766C0E249097485A5581EB0C4F05E861E9
                                                                                                                                                              SHA-512:0C179F50CEE0E32D5D760E69333C6BA9F0A7A0515334C69D9FB06A93B6F5A2B595A55B696D2C00D10CCF635EEB75B09A624F742A6134B320308E1CE5A7952001
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ..?.......?..<..#k...h....?..<..#k...h....?..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............@<....'......2.....N...^.................D.}.O..gM.l.........f........................................I.qk..B.....LZ............@<....'......2.........@<....'......2............?.......?.......?...........................................?j......?T.]....?.......?..B....?H......?..B....?..>.)..?..J...................;........4...4...4.."................?...?...?..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4...........?.......?....#..?............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002P.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 70x626, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3428
                                                                                                                                                              Entropy (8bit):7.766473352510893
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:/hdu7isPwAp7zesusUyYAatNG87llTONQYS:5di5tfuQ9atNZlaC
                                                                                                                                                              MD5:EE9E2DF458733B61333E8A82F7A2613D
                                                                                                                                                              SHA1:A86704C969F51B86D6A05ED51C6C60214ED9FA89
                                                                                                                                                              SHA-256:BE4F0E6C89FCE91B9EBD2623567F7DFC259E0E3C77C9158742B8F64B724DF673
                                                                                                                                                              SHA-512:BFB5D6DD6B66EE21E946E90D1E482384CD10244308562DDA814189602681DADDE5752B80519E5B8515F115A71BD6BB4317A59BE65B8B5E3474AED119F8303569
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......r.F.."........................................H............................!Qaq.."12.....#3ARbr...$B...cd...&CSu.....................................+.......................12..aAQ.!#q.."................?...#...3.Za......rV.5&...../"..i.t...j..W........d.FL.V.2K....]t.f.d.NK..:.....f...... ......2.[...#..D...ZK....p.z.E.N..T..L.-....1....2.\.6FIr2..zS\U#..........fB\t..5J..~q...D....A.......!....MY..../.HY..../e.M.Y.n.~..,....'..Pc...l...d2..m.f.it$..qx-z*...._..].cOO....n..&.....FIA.....2J2..d:<qc..6.I.G.N....f.K..Dx.-.......`....2.FZ."K7.r}..<.P.Z.da.Y.....8..s....G.....b.e..g .S.......FL.Z,&..q.MG.J+..x\..m...qN=.....)..`...&Y...S....u6{.z.g.....@......FL.ZL&.Iv.w..8....U..v...*.q.B.v_./A..#.#.g.j........*J;...u...W.Ao...%....#$.....M..^\{W.SO...s,.N.....c).,.B.Gv...."k..z."..S]H.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002Q.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.3430895769530355
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:sslW6MlPEXNrxdXI9HkRQyw/TOyaTAPM:sslW6ZXNPXI9HkRJw/TOyaTQM
                                                                                                                                                              MD5:EC5EAAE989CEC96ADE6223EB1C6FEE8C
                                                                                                                                                              SHA1:84482A6D78CA5D18A7A0855DBA45ADB43EB14F1F
                                                                                                                                                              SHA-256:B5299FBDB74686F0E2039605AF52CEE9A28395AE6DFF2777F463FB1D55A3EBFF
                                                                                                                                                              SHA-512:0B2327A5C8F0EC04B5A903381074A60024ABE7AEA5D6693CA011237DD4AB77619FC3141B6C4C30D85C986C05792F0F03075D7A0BA4FCB4033C304846FE76C6C9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZtf......tf.Z.......}.FMBtf.Z.......}.FMBtf...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............I.p.>.y.7/..gw.K....N...^...............R......O."...".........f........................................I.qk..B.....LZ............I.p.>.y.7/..gw.K........I.p.>.y.7/..gw.K.........tf......tf......tf..........................................tf.j....tf.T.]..tf......tf..B..tf.H....tf...B..tf...>.)tf...J...................;........4...4...4.."..............tf..tf..tf...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........tf......tf.....#tf.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002R.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 177 x 123, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):65589
                                                                                                                                                              Entropy (8bit):7.960181939300061
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:2Hlrjw3xL//DPgff+9j6yPWvHMHjkbfnwHO3AW3GL:2H2zDUU+yPVHITwNfL
                                                                                                                                                              MD5:8B48DA9F89264D14B83FF9969F869577
                                                                                                                                                              SHA1:E1BD58E2D80FEEF56DC514F3F0B3AB9669F22F95
                                                                                                                                                              SHA-256:62AD3C277E54F03F1ADB44062407346F789E63859B7AFABFD64BE6AF5E9F66EC
                                                                                                                                                              SHA-512:03B783EC968DF3F648504D068D64DD1AE110E28110FE5B3401C9D04F44897DBE0CBB5680D42CA4C665FA94A6CED4B559106EB3C06C9BF2C5B14951ECBFFAC8AE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR.......{.....;Za.....sBIT....|.d.....pHYs...........~.....tEXtSoftware.Macromedia Fireworks 8.h.x....tEXtCreation Time.05/15/06.8.p....prVWx..Y=.+I....t.y...,^vv....;. "|. .i7.....$.2g..']pH@p..]b....H.H.......d'@ B...U.xm..3{3k?..5n.._}U...3......~..>...g.....f..t...t:...p>..Si..d:..k:.Lf..t6.K.i....d<...x.8\.8.+lc...)i.$.r.....x.t.BG.R.cm.c...p.:&.6.4..K.......^...~b].0....oBYv..u.'.=.K.Q.g)6.....4.!.M......4.=....G.%.Sr........nxC.F..t.U........1...J.t..eQ....".... |...81.$D.!.>...........$...^.vY..EY8tb..'.P.g#O....S*..0'.V....x.W..........k.......s.C.S...J%.iVb..].........3....j.}*.z....+.s..@..K.....\x.C..e.Qq.....;N.....;....,....^.*..$F..{G...8.#....8'..&....8..5.....3(P._....S......|".....u.cr....+a-....&V..x...iI-<|a.{E.c.X.......?..&.C....'........(.x....>...M.?.9..#X......l...0...Z.F..<.z.0}Q..Z1..........?h..`E$K.2o.A*c^.......*..D..uL=.}.#*0.. M!.A.C......|_..(.Y........!E... .O...`;....M+..x.u~g...q>...N."D^..K..x..D.`.!.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002S.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.3557590349678925
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:WsFbd7GmzLt8q9/EmdPrkXR0isk9mdo1rdQqr0FCeBX6C/kjOZ+PF:WsqmzLmqtEmdoXRH79mcRQyYCe8McrP
                                                                                                                                                              MD5:F11FA635B348C1978987308FB6CB21F2
                                                                                                                                                              SHA1:A43D63EED219C814F6572269600E9C064DF978FF
                                                                                                                                                              SHA-256:61C3FF80345EF103D63D2D305451A6D70B9A2DA96FE9975C62BDE1A656270073
                                                                                                                                                              SHA-512:93543896208BB469095C985D638D5F42CA4CFC3E36840EC31124F2BF9571D700FEE9D8E52D1DF471F0176FB8E3618A68EFBAFBBE7D71B9A1A2677B958804D198
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......V...v...J...................................................................................................................................2...>...2.......v...~............................I.......I.qk..B.....LZ............S....1d..f.....S....1d..f......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............\+..go......4.......N...^................T..%.K.Y.w..*?........f........................................I.qk..B.....LZ............\+..go......4...........\+..go......4...........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002T.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 17x608, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1873
                                                                                                                                                              Entropy (8bit):7.534961703340853
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:N9YMw9kGzE4xTdow1C3kyIkyM66KeJY3fOxJ:/h8HzE4xTdoUCUyxyD6LCvSJ
                                                                                                                                                              MD5:4FC8500BD304AD127AF4B5E269DFF59B
                                                                                                                                                              SHA1:9A5E3432358A0FCDECE86AEB967319B93A65D14A
                                                                                                                                                              SHA-256:B4DAA90D5A53FCBC85119050B5B76962443C4DD18D7F42CDC6D4E0AD8EFAD872
                                                                                                                                                              SHA-512:E5E07054A522EB91EFD39722AFB3776389632B8F5F923C1D29796716D68CEC93BE5E44F79913804CEC7ED631FF520CBBBAAB841E01FB90AF8E8ADF84DCD47481
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......`...."........................................>.......................tu.....45.!#$%1s."fr...2Fq..AQe.Eav............................... .........................!AQR.............?..e4.bbu."m.G......u.S.-Qq.b.a..'#..E.......u.|:.f[O..jS.S.&....=.....[.....S...N.~~...'...q....N.T.Oyf..a.6..%.I.1j.e~.4..[5.WW.Y..Xp.gn...u.......Gb.O.W..k.!mJgfq....~.F.......m..}bn4.5........s,F...z.b)..O..*...5).-.-\....=`.fP....%...A..Q.&..9.....QQbD.%.:u.f...r$.10..W.F.T..MI...9...ZQH._..).....D..n.F].........*.:.j...!6Z..S....0...B.6..Ga..S.O.....U8S_.J.>...i..?..<.P..........M..F.T.C..7.E...`.4BKcMh1j....4y...+.|.^......2[.WG.W..+......E..r/V^".R...."..6..hht..f...........;E..Kx....)}Le.A.x.>..$/).._S.n.L......}..H^Sw...2. .v.io...../.........x.>..$/).._S.n.t^;O.....n...[.S...h.v.io...../....:/...[..7yK.c-

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002U.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.453492556986942
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:KBsWNhhQXyli7nSmctUEe9Xy9XJEAo/rdQVru+JBXTpikCQNhep3sl:WsalKnjcWESXy9/CRQ5jH
                                                                                                                                                              MD5:2A32D4FE24F92B0501C78020C01E03E4
                                                                                                                                                              SHA1:5557B7D20E0EA35D1B82F9A3555A8B61DA7DB773
                                                                                                                                                              SHA-256:DDE7F895FA057381615E12FAB911B8C3C7568DB584936E84D85765F2C66F1944
                                                                                                                                                              SHA-512:50F74E32CED1E86EBF25F889C88B3FBA74AF6766977A58E8830808A55A2163A1D30ED109308C45853340BE8A485BAC2B534EA2D3BDA3AF2750D794986B8CAB53
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......n...v...b...................................................................................................................................2...>...J.......v................................I.......I.qk..B.....LZ.q"......q"..O...W..4....q"..O...W..4....q"..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............6..a....!IG.........N...^................L.....E....|...........Z........................................I.qk..B.....LZ............6..a....!IG.............6..a....!IG...............q"......q"......q"..........................................q"j.....q"T$c...q"......q"..G...q"..H...q"..>...q"......q" .3...................;........4...4...4.."...............q"..q"..q"..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........q"......q"....#.q"............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002V.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 357x69, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):5465
                                                                                                                                                              Entropy (8bit):7.79401348966645
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:X0cZneDWlIKmXwxacOHHI6EhzNlSSDDgafbofgt7mGrw:XleDWlIJwQHihRdgu8imGk
                                                                                                                                                              MD5:8470F9A96B6C6CAD9EE60961E96D19B2
                                                                                                                                                              SHA1:AFE1F01FFA4E4CB06B1D770C9C59DA75B434D1AC
                                                                                                                                                              SHA-256:2DF453410796AEC7B9EFEC00059B6CE64BCF67313A95AE458BA600EA5DE14811
                                                                                                                                                              SHA-512:CAE5C2ED091BA49761F0348516D53491E578FB165F32F93AC7DAD927383E9A398B06229FAC6A8233777DF708E5001AE0037A1FA960293BDA49892C40B37F2240
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....C....................................................................C.......................................................................E.e.............................................8...............................!"1...2A#Qa.$34bBDSqt..........................................................?.....`0.....O...3Sd..@..5.0....Q.pw....;....!pN.DR....`0......N^...k.=.u.e.7{.b........?z....zV...M.....P:a.SPj.....WRK.=x.2.h..2..AS..s..A..|.Z/f$D.YX1pr......}G6._.~..)j...+.s.r".{..q..-.^@...#w|.H..*.K)....g...y..`0......2.w@.Ro.d....@...K....}...&... y..f.y.0.|DC..>p.[E.2......v..N.)Z..4.RF.D.8]..Z.|f/..+\ID.r/.o........0i..*.G.O..uj..RN. ....j...xnF...Q.Ls.U.c.D0m....z.k.P;f...b.=..L.hH.,./;.U..`sa.I...?*...I....M.0<.u....!..C..U.T.....s.Q......_..7K..*.....?....R\&=.<.u..oQ}WZ..Yu...{Fe3.h...@.s..mW.G..^....1.W.#[.q2.&u.c.G......`J./..X.C....M;.....3k$}.i.3...#/x.m.Oh.}FH]. ..5NNDIS.-.M~...6..w.d....P.;..k...........v*..T..L.P...s.!B.4..w

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000030.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 14x341, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3361
                                                                                                                                                              Entropy (8bit):7.619405839796034
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:zDqnxqMt6gGr/Nln5ANln5ANln5ANln5ANln5ANln5ANln5ANllHN6:CxqMQr/rn5Arn5Arn5Arn5Arn5Arn5AN
                                                                                                                                                              MD5:A994063FF2ABEB78917C5382B2F5FA8C
                                                                                                                                                              SHA1:BD5C4D816B04A2B6596DFE38DB01228F553FACCC
                                                                                                                                                              SHA-256:D72900E8DA72D1A7F3729971AA558E1E9B6E9CF9A0D51E83852E567256DBBFEF
                                                                                                                                                              SHA-512:CF2279033DD3EDFE6F6F9E5C517BEBD9A52863EEFD90F57F7A5AE0E0485E705254BE7ED6B50E6CA142669687727AE85E2E6035F69930B75F2E6D3EEFA961EF88
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....C....................................................................C.......................................................................U..........................................>...............................8H........59...$%&7F#'Ddf.....................................>.................................58EG........!#124$%&ACFbcde............?...n.p..v..a.~.._.>......#....8.....w.G...&.W...i...%6m..K;...4."...=..?.~......P..O...j.l..AW.jo..,..=d.h.ta..../.."...z|).J.......Ww._..<Wp.3+8...-5...G:..2.D..I>o..K.F;-.....#...`...6..T...M.....OOgV~..5...np...P..TYr...........b..{r.2.9..].DA.%C....=.v.z......CK."..R..l..y}.i..;.{....JzS.....~.?..Z....=c.h~*..p.@(@..G.....O.]...Hsd.xf".V]..S"..w...4e>....3*U.7..|M.x...|\......FD./.cIe.;.bId..+=...w.......[.k>....}.u...j.xZ.....Q4..+.....B....1O~\......I..h....LaXJ%&.w.<C...n/`.W..U.W.U.}~...}>..^.0.J.....@....LN.b.......5W...m].Eu...:....G..:4.=4ixx..@_0=.mab.T.U.....w..~.V.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000031.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.351169907831065
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:OsP0m7DBqCEbXXJ9Ujf8RQyPtDnmdkJTTR:OsP0m7DabXXJ9Of8RJPtDnmdkJTT
                                                                                                                                                              MD5:59941286288F0318AF16F44CCCFE53BE
                                                                                                                                                              SHA1:30D99275A24D2868A3C2866DC78223D1763BCD83
                                                                                                                                                              SHA-256:F50C4EB193F07012B11A65AC0B85EB9EB8926B9AC81748F9D6B66076F4530CD7
                                                                                                                                                              SHA-512:ADCBBCD355E18542A53EF713540625868F6AC29EBF56494B6C9D5A5F76DBD80506F8D78551B207325EC68B018FAB277D94523ECE275A86E849344D118FAD8DCD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZg*......g*.s.V...\+]...tg*.s.V...\+]...tg*...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................c[...A....Dz....N...^................]E.g2)C.S.n..G.........f........................................I.qk..B.....LZ................c[...A....Dz............c[...A....Dz.........g*......g*......g*..........................................g*.j....g*.T.]..g*......g*...B..g*.H....g*...B..g*...>.)g*...J...................;........4...4...4.."..............g*..g*..g*...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........g*......g*.....#g*.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000032.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:15:20], progressive, precision 8, 604x784, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):140755
                                                                                                                                                              Entropy (8bit):7.9013245181576695
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:i/aDiblRsFcOco8dofE5Zx1+NQI8Wh9aiOe5NTO:mnbM+TxaAi98W3aiOwTO
                                                                                                                                                              MD5:CC087700C07D674D69AFDFDA0FA9825C
                                                                                                                                                              SHA1:F11113DF69DACDB255C6CBCFB29C1D1CCE40B346
                                                                                                                                                              SHA-256:A7FA7F092EFF43030A56342C39A765F8D5CC48C7DB815DDFC8C1E5EC40117FAE
                                                                                                                                                              SHA-512:843202D975EFA91E73287052A893584B6E5AE601F91612B56539AA2F73D1AD3F997FCAD1E711E0F483A2E91D46D9643D0B026B43F4E94116A5D2FB6551536034
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:15:20.............................\.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................{.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.......J...\O.,......../$..........OE.m.o......T....Z..l.g.-....m.?...Y....3......"....].j.X.k.S.k.....4..R....{....?F.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000033.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.350090397659957
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:Y1sdz6ApiDUvIGMEuVuXlW9StARQywZqz/9zrzazgz/9zMVzOz/:OsMAp+UnpuVuXlW9StARJwZW7R
                                                                                                                                                              MD5:E08034AA84668FCD84B38C29B1781D8A
                                                                                                                                                              SHA1:213474F9857515991D77CB6F6736FB60A80DC7D8
                                                                                                                                                              SHA-256:1EC816F2BED5F5C2226FF97133409AE82FBDDFDB3170F263AE541A6712BD29F2
                                                                                                                                                              SHA-512:A148A990E139C9B30AB26842B07BE808FF1050DB0C58998FB6CC2F9C2C2C4605C5BE120782C5FB391E8E60A9C744DFBCE013DCE40F30B76864700343BC24D334
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZD.......D........^*.n1_AD........^*.n1_AD....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............0.......+..8..Y.....N...^................n|.57.N.^.W.*.5........f........................................I.qk..B.....LZ............0.......+..8..Y.........0.......+..8..Y..........D.......D.......D...........................................D..j....D..T.]..D.......D...B..D..H....D....B..D....>.)D....J...................;........4...4...4.."..............D...D...D....z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........D.......D......#D..............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000034.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:13:06], progressive, precision 8, 570x779, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129887
                                                                                                                                                              Entropy (8bit):7.8877849553452695
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:QS1x1rXglsteJ79wHi4vNQR5yBlUdOSILe9hSj9jeWMPjdlOJ:vvglst1HiwWR5yBA2LeS9jd1
                                                                                                                                                              MD5:737E96E41D79D3BDACE7AB4F8CBF6274
                                                                                                                                                              SHA1:E6202A41A4F86B27D9EBCAEF7670B16C0ED67CF2
                                                                                                                                                              SHA-256:7966F3D8A2D61ECB49A35E163781858E052C0B122A18A1238AFE27B57E2850E8
                                                                                                                                                              SHA-512:D398C8521DB2FB3F8456FE792CF37472F3B851DD7298DB20E2DB79144F8E846D051878E77E5EF5D00E6840EDB90C6E2D97935BC1023A15FC45038CCE731E9895
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....iExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:13:06.............................:.......................................................&.(.................................3.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................u.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...W..I:..*....a....Aa ...w.T.M.v.........3x.......8Y....$.."-..m.I.0~sxB[@..=...:..\.Y?....@O.L;9i..U....?.5">+9.s\Z..vN

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000035.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.340696605986021
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:Yz2AsHhVNK/T4BEr7vXYT96V/QRQydR5XItmXn8hE:02AsHhVNK/0er7vXA9O/QRJdR5XItmXP
                                                                                                                                                              MD5:360A84CAD556F661041247F94EF603EA
                                                                                                                                                              SHA1:FD505163BE1FFE263CDDC74732CA0231AE5554CF
                                                                                                                                                              SHA-256:486F961648AE9B2B37BEEFEA03EFBB081729CC82512DC4A0CC2255E17D9BFD91
                                                                                                                                                              SHA-512:630651EB38C7451E98CEFF633388650023FD7F60C70F30CEAE4BF7CCCF920C2F26DFCA276BEF8E101C717DA8A7D063A41DF7405519A2075BC125D8D6888EBBC5
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ.............p.../..2.....p.../..2.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............Ov.....%f.V.1....N...^................%.+%.oJ.....;........f........................................I.qk..B.....LZ.............Ov.....%f.V.1.........Ov.....%f.V.1........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000036.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):84941
                                                                                                                                                              Entropy (8bit):7.966881945560921
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:X3sWfhTVd+xu6rA6SOONM0/YFXnviDwoPCaNSm+z/ze/fWNj7GfigeKyCGzw+QKW:nsOhdDJOwY1voPCaom+z/zeHAfGihCG8
                                                                                                                                                              MD5:CB84C108A76C2AFFCAC2551A3C1EAD56
                                                                                                                                                              SHA1:8BB7C2A12B056C1ED12EBBAE5BC9F60CCE880FFE
                                                                                                                                                              SHA-256:139BB0E79F89C3DDEF79B1716A5FBAB4C07DF5785FB3CDF6B4EEDDBF6C078452
                                                                                                                                                              SHA-512:6EF85144E9A7ACD0FF2E52A5FF42093153EFB69127B1C8549EEBC49B6CC196A46B65EE39A2CAD0206F6A41476D8B5B35D29EAC9942B8F84972B32E14CAFEED27
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d....................................................................................!.1A.Qa..q...........".2..BRbr#.T.3C....S$.cs.D..4%5......................!1A..Qaq."2..BR....3...b#.r.C4.............?.......m.q..'O.....r......_.1....8h....?.....O]~..k......GO...''._...!....o........''..g..H?k.......1...?.....z......>...+0..................GO...''._.........}.O.Z|.L?...........?.........[~t.......}......NO.....v.......J.......?..g..H?k......GO,m..r}o.z.....}......dC.9?..g..H_..........?.....O]~...m...C?.z..f....W.=u.B..m..C.-?.a.....3._.?.......o....np.M....g..H_............9?..g..H...../..kO...''._...!~...o.....0.M....g..H.........../......O]~.~...o.......7..+.... ..l?.}........&....3._./....?.........W.=u.C..m..C.+?..o.W.=u.A.^.O....:......_.........}..t

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000037.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.3363108759636635
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:Yu6sKrZXhCOnNAZt+HuEe+h3XLU9+ootrdQqrjx6wzoBXihYCPtCnFwB:Yds6NAZDEPFXw9+okRQyF6NG
                                                                                                                                                              MD5:7DCFDD5A12B9C4500750A975820E06C4
                                                                                                                                                              SHA1:84776903B23B5E2EB6083898851E820E3B1043DE
                                                                                                                                                              SHA-256:3C38925DBE9CD37BA5F81FEABFF54F40BF657C083800CA6E5B05F1DD947A5F5A
                                                                                                                                                              SHA-512:3EE2F3477FBB375B8F6B63DD4C95DB51F6C58185E4ABFD60F6E267535C010A377CDDBE3F3C3F3AC7D615153530271AA5119473195B4CA4D89A53BA36CA8C70DA
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ]T9.....]T9...i..-..m..]T9...i..-..m..]T9..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................W...R.\.......N...^...............;..C.%AK.......$........f........................................I.qk..B.....LZ.................W...R.\................W...R.\............]T9.....]T9.....]T9.........................................]T9j....]T9T.]..]T9.....]T9..B..]T9H....]T9..B..]T9..>.)]T9..J...................;........4...4...4.."..............]T9.]T9.]T9..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........]T9.....]T9....#]T9............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000038.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 40 x 623, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1569
                                                                                                                                                              Entropy (8bit):7.583832946136897
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:KArPoy/sSfmBL0EGEsRgeTLLXFnViAAEslVorlP0i8OmO57EnGAkYelBKMN:9oQPTgeL5ViAe8rQs7HAkrlc+
                                                                                                                                                              MD5:07DB3F43DE7C1392C67802E74707DAA6
                                                                                                                                                              SHA1:C173ADB1999065C5E1E6DBEF934B4D4D7AF0CC23
                                                                                                                                                              SHA-256:51E05999A1C9F17DF28CB474E57DD8E64BDAB824874A532C20A23766A01F8967
                                                                                                                                                              SHA-512:E509255519D4E521E82332FF418DD5A6BBBC8476399A0D9C3D81542C1CABA535B2D79E5BC90F73F9EE8468643302137671934ABD600FC696F16161C91FEAC111
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...(...o.....>.c.....PLTE................................................................................................................................................................................................a.o.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.Y.. ..........}%.../].`<..y....V...m.....<....)..;Ki..'9...2.:.c...t..V..d.t;-y.Z.=K>B.."{Lj.~G..|..ENC.!Sw,....";.p..g....E.B..S.-...k..P."..E......l[./D.-.....Q+.G<>.+..b...#..y(...{a.M..J...<....v.W..F.qm.`.....(.mk.nX....l.Px8.0\Z....7G...$*.....&..Z.VJ.~......J.2|...2H..../...=.)q....ZT" .,%..h.p....Z$.!........r...Hh.f. ....P .d..1d....2.3h....;.A.... ....d..g4...A..^.....2.ew..."h...y/..j.h..B.......%.2.%..{r...+dG.=9h....P1...A...c...^h.]Q0.8x....q .!3....ZW"Z.!3...G.vC.GG..".&..X!3.|xB..V.P!.+zS..NX!3.....Nh.y(.Z.1.h..B...Z+....l8Xcu.B...K...@U..@Q...mB...x...&L C....mB.....@kC...Y.,.... ..e\F.B..........y..e\..:$(....Z.a...yn...f..z.~Q.{o...].ln.r....^.@.{..c.7..{...

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000039.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.358263934208726
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:IsJ+uKQkpdEplMXs9uUARQyAtu1PZtTe:IsJ+uKQq6plMXs9uUARJAtu1PZtT
                                                                                                                                                              MD5:28759D49D0F9A2DA07341A4FF627D1D5
                                                                                                                                                              SHA1:67EFB4FA9E7C4DE53389B1154425649E62129186
                                                                                                                                                              SHA-256:5B4B84E4D12E510D04E07945D62E2E14DE0401FE52EB09D6E8D50806AB0890AA
                                                                                                                                                              SHA-512:823D5F5F30701F31545FF5C2FF6078D111120BFE1D0869A35EAA2E98510967EA1BE5F0F120B300DCE4F66793B0034BE8566AD62D7AE9B65E95AD5E0C5B51443F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ..T.......T....3.G....`..T....3.G....`..T..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............>M......6Z...{W....N...^.................3....G....5W.t........f........................................I.qk..B.....LZ.............>M......6Z...{W.........>M......6Z...{W...........T.......T.......T...........................................Tj......TT.]....T.......T..B....TH......T..B....T..>.)..T..J...................;........4...4...4.."................T...T...T..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4...........T.......T....#..T............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003A.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):40035
                                                                                                                                                              Entropy (8bit):7.360144465307449
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:MQhziQo1RKGlyyzYjlxuxwRUj/BN837xRmwH2uDTCn8qXFQziN:ThzrSzalg6O563l4uTC8q1Ig
                                                                                                                                                              MD5:B1DDD365D87605F96D72042CB56572F6
                                                                                                                                                              SHA1:ADF71DAD1A62B8A58A657C2EDBDD665A19EB846B
                                                                                                                                                              SHA-256:06E09DE80C3F32254DA4FE6B2CBAD7C05EF144DD54B8C65745E195BBF7317A2E
                                                                                                                                                              SHA-512:9C686092CC9524F34EA6CEC9AAE936A6225BCC54DE38DE1786EBA8F532959A80FF885E8664A09E4C318D7CA4B278E807D3D1F135BE55F30979B844FF5EC9699A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!1....AQ.aq.....".3.5...2B#s.$%..Rr.CS4&6...bE'7.c.DTtU...d.eu...VFfv.Gw.....Wg......................!...1AQaq........"2..4..Rbr#3$...B.s5Cc.S%.D............?..^.f....R*.N{.{f.....O.r.V.;U..~...U.(..>M._.yI.{8,..^.t...s`...j.O..U5t.&&..h.G.6Da.;.....J.......E..QD...C...}..N...tR.....~..].J:.V$.*.r......]...W......4.[.)6..Y_.....4...........m._'HR.a......]U=.....n...0.W..]..K..){.+...w...f...<|..1/.|.....b..-..y....]U#Ctn.7m.._.|..2I;|....tM....q.q.}.N)....'...9&...nR...R..}.........m._.LZ}u.../K....9.~..?.{....V.#..dx.Zk.:=..:.j].....E#....E~w%....J..[S..[......gr...vb.r]..<..ut..i...[P.w....:..Gkn>......#..m...9km`......t).up.....w....VOR.{&.nQI..}...wD.7Ey#n....MO.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003B.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.643999699408699
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:RsqdvH5Utr9/E3/LCDsXsXs92/loxrdQqrrOBXt8seJN:RsyH5UPE3/IsXMs929gRQyie
                                                                                                                                                              MD5:E6F262F023C7B5C3B8B9482FA97208D1
                                                                                                                                                              SHA1:6B868A51D17E260B6DF85E193468264594E8F2DD
                                                                                                                                                              SHA-256:42C318CE00303346B77B9ED7FD07F7DDA675C3EF8ADE38F5E53672C8BD084308
                                                                                                                                                              SHA-512:4D904E9EB4F7D6E1CC18F39A6EBFD0A8338B5F1E423EB44FBE3E579926FC88A054C088357EF94C570ABAF42CEEEA6D3B204848AA4A63D98B5A3723A9C212CDB8
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>...........v...~...................................................................................................................................2...>...f.......v................................I.......I.qk..B.....LZ..........b..)..b.s.....b..)..b.s......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............@X...=...E.y.s.o....N...^...............I.hA.{mO....G{..........f...................................:....I.qk..B.....LZ............@X...=...E.y.s.o........@X...=...E.y.s.o....................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4......................#..............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003C.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:10:32], progressive, precision 8, 594x773, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):242903
                                                                                                                                                              Entropy (8bit):7.944495275553473
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6144:YVxOYlZX2kCWfYoFMXC/sBFC9r+4iEGM4rrcPoWmwkU6FJ:+OwZ2kbFMC/L99ifvokU6/
                                                                                                                                                              MD5:C594A4AA7234EF91E6C2714CFE1410F1
                                                                                                                                                              SHA1:C0F720D4CE3196852814D0B7347F0CAA0C6FD526
                                                                                                                                                              SHA-256:10C833E47BE1C8496F949A6B059C2D79212A4DD66BDE62116EA337FA4FE0B654
                                                                                                                                                              SHA-512:7313F6545A334F9E2DE5430B2DB5C419C4C8A40E075338DAFCD74970BCC6309786946E5DFB57531612BF4C6269495655706D920FD99922FDACFF9796710DA9C0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:10:32.............................R.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................{.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...v&.F;-v;}FH..Z...N..)Y.......h;C....G.0W..ww...MI..Z+..\.........c..4.1.~.Yo.Y6.&. q...............l.A#.~s?yYg..7ky...r

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003D.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.339344067237498
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:Yu+sFvp1uq2t38pd0eEQtbRgqEXMRLLX619qYoJrdQqrbDTcBXiLkQOJDkhkckfY:Yhs/2t3Yd0FQ1ZEXMR/X619qYIRQygS
                                                                                                                                                              MD5:2D4A0609834304FCF39FF6DA91116F24
                                                                                                                                                              SHA1:1C213F3513B99D66BE3A8FD876DC47FE409D8539
                                                                                                                                                              SHA-256:5BDEDCF73599E2F8AF6F871E383B284204F6265534D29BAF9E874D1CB0383C72
                                                                                                                                                              SHA-512:B674D6623963096837BB488D0AA047B0228C2CF59EF2DA94D09BB3A93ADEA7BEBEBDF73A343F938E9F6AD8766DE441BDE9AAFFC69C0A0F7CA264F6669440B01B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZd!......d!...u..0>44..%d!...u..0>44..%d!...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............,f(u...@.;.......N...^...............o..C.=JJ...g.,..........f........................................I.qk..B.....LZ.............,f(u...@.;............,f(u...@.;............d!......d!......d!..........................................d!.j....d!.T.]..d!......d!...B..d!.H....d!...B..d!...>.)d!...J...................;........4...4...4.."..............d!..d!..d!...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........d!......d!.....#d!.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003E.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:12:29], progressive, precision 8, 598x766, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):70028
                                                                                                                                                              Entropy (8bit):7.742089280742944
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:ub4bgbB7g9cKCmSzaNF0jAdAzQKTEFBQqUp/i0yG1pidLHTVX:ub4bIB7Qg2OjbzjgWp/i0yGCZx
                                                                                                                                                              MD5:EC7811912ACA47F6AEB912469761D70D
                                                                                                                                                              SHA1:C759BC2D908705D599B03BDB366C951B11F99A4E
                                                                                                                                                              SHA-256:FBB4573E3BEE1B337077691BEBAE15D6FAC52432405D31396D526D7694A8283D
                                                                                                                                                              SHA-512:881828150993A8C56E36CDA2051D89C1F6E0322643902C9506392C163E8734A2933A46486F40E5BC8C8D0164E180605E52620EF22FE14540AEA787A38B22E98E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....7Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:12:29.............................V.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................}.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....H.yM..? .Z.. .^.x..p.8.A...K.... .\{..)..y....t..=.^y)..v.@.W>. .h.. ..p.:.\)(.$....$.I).....!....E..Z.....&.5.).

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003F.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.345548019030073
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:jOs4FUt2uwQ8zE5VxX7v96++xsRQy7pfMT4yRRPtlmJ:jOs4w2uWgXxX7v963xsRJ7pUT4yRRPt+
                                                                                                                                                              MD5:920B0888A97E07B681C1116AA46DEC5D
                                                                                                                                                              SHA1:92ADC1AA78077748FA088B9B067422B2B893A7AD
                                                                                                                                                              SHA-256:300B2ADB23DCCB4B0938E186495EA0C6BE450331A55BC92C81D4B652E63D2F6A
                                                                                                                                                              SHA-512:808A4FE68A583A9DB9BA500EB620249CB602241C3C4E92FC8A6017577A6DBB3F38BF44B1DF49DF3E7A04F74353D7024C5CC89A123EC6EF71D1A154F1334386A2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ1.......1........TC.G@fh1........TC.G@fh1....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............&...(+x.;...ml2}....N...^.................G...HA..c.m.M........f........................................I.qk..B.....LZ............&...(+x.;...ml2}........&...(+x.;...ml2}.........1.......1.......1...........................................1..j....1..T.]..1.......1....B..1..H....1....B..1....>.)1....J...................;........4...4...4.."..............1...1...1....z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........1.......1......#1..............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003G.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:19:29], progressive, precision 8, 221x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):24268
                                                                                                                                                              Entropy (8bit):6.946124661664625
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:d2wiieoHTRh5a1HAteZCWOZIM+L7WhNjYn:8wHFHJ+/OZIKhNO
                                                                                                                                                              MD5:3CD906D179F59DDFA112510C7E996351
                                                                                                                                                              SHA1:48CDB3685606EDD79D5BCDF0D7267B8B1CCBD5A8
                                                                                                                                                              SHA-256:1591FD26E7FFF5BE97431D0ED3D0ADE5CFC5FA74E3D7EC282FD242160CE68C1F
                                                                                                                                                              SHA-512:2048CBA13AF532FF2BCC7B8B40541993234BD1A8AB6DE47B889AF3F3E4571F9C5A22996D0B1C16DD6603233F6066A1A2A97C16A6020BEDD0826B83BAD0075512
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:19:29.....................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................$.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....)......[]t.\Z..g......A....&D.$LH._..X..Xl...`....cZ.X.........>......f.Z.X...]..~L.S..@..I$..I.IO.....x...s.g.[f.h{9..

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003H.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.320211851323744
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:WsF2RITolmlEhXf9qowRQy3M2RCbCGIxN:WsF2R2osyhXf9qowRJc2ROCGIx
                                                                                                                                                              MD5:7FE9FEDEFE017A7CA637E004117C6C2A
                                                                                                                                                              SHA1:5CB548B9B24627898934F97CE2E7697ED77670DA
                                                                                                                                                              SHA-256:44102AD8608CBC148C4BBC6109310CD3C4B846F3580096BE1B981203F895BF73
                                                                                                                                                              SHA-512:FFC166A1185B26359E8714A4A3F3563A10021D1DE440D15D21DD4D5B7390573CA712F0EC8598753A89BE9E5CDFC08FB2FCE16B9C1F59212A2267E199223A54B0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ*-......*-...@....:D.*..*-...@....:D.*..*-...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................AO...z.........N...^...............?m!...N..5.0.l&........f........................................I.qk..B.....LZ...............AO...z................AO...z..............*-......*-......*-..........................................*-.j....*-.T.]..*-......*-...B..*-.H....*-...B..*-...>.)*-...J...................;........4...4...4.."..............*-..*-..*-...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........*-......*-.....#*-.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003I.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):47294
                                                                                                                                                              Entropy (8bit):7.497888607667405
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:aQ10VrIBdBvDpQrQ7P9/FUOLG2vTSeG9lkCsMKzXeMBk3CBp:aC0JIBL+QsOLG2+ZAC1KqM2I
                                                                                                                                                              MD5:7A450E086AD14BA7D89BA5DB3D3AE6C7
                                                                                                                                                              SHA1:E7AEAFCFCE476390E18C19456BDF6529D863D518
                                                                                                                                                              SHA-256:BDD997068701ED3A00A224EB694B003C01AC69B857FE7B4147D6C34875B1632B
                                                                                                                                                              SHA-512:9B6D50A6CDB6081DA107A2CDDB1BD2811A5764994C8E3F67D56CA81084BE0D068C27435154E867199F38688EA65E8DE02A56DCAC47D0F5E55F0FBB6598814938
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..A..Qa"..q..2.......B#...R%.r...$&b...3Ss.4dU6F.cE..'GC..t..5eufW......................!.1..AQ.aq..".....2BR......r.#3.d...b..Ccs.t......$4T...SD%5Ue&Vf............?..M.7(..).:.a.q.......>..[:O...afQ.uCO..U.....go.l..p..YqVklQ.{i.w&.]Z.\+JQw._.n.'.h..,.bj..X.].k&.Q.>gU..f...1|....[...jQ.%Zb.......t..........*..V..j.6....Vj..i.....?...IY.P.....$.j........[l.....S.4.J9.U\.......7I..[..=*N5....xW..../...=?n....uG.D..S.>...8..3........n.S....]k.*...4.>.R.o..{..l.H.#.^....<amG.m&.......,....wDY.W.m.X....We.IR.Nu...y..Z.l.._S.mr.m...y.]m.R.MT...6.5.5}.K..#%..k].7.Y.q]...%.r.7.R^jR..z.K.T[t.a..d.)glW.r.v,.`....O..^..o:.Uc.\..D....f..D......yt.Q...Y.....

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003J.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.464632966940678
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:eTsKMt6+0oEw4X29ye0RQykjTwh6TAf8:Usl6+uw4X29ye0RJk
                                                                                                                                                              MD5:A067444876272328B1DB0B5DBB191B8D
                                                                                                                                                              SHA1:6AE4BECAFEF62642BF9139EFDE2F95635B65FBA5
                                                                                                                                                              SHA-256:4A0ABE729DE9FBDA0027BF0AD6FE4F73343F06BAB1802C1A78B28A1C19AB622E
                                                                                                                                                              SHA-512:1A9AEA95243D3A62246F9406CDB66054EFCE97349F7DF06F3A800C437CD75013B5E2DDEAA5DF6E50C7130BEB1A0CE43BF5338F2D9CA94218CFC60FE0738C2EDE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......n...v...b...................................................................................................................................2...>...J.......v................................I.......I.qk..B.....LZ.)Q......)Q...j.......k..)Q...j.......k..)Q..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............pm{...E,.i?.5....N...^.................p+...D...z/8. ........f........................................I.qk..B.....LZ..............pm{...E,.i?.5..........pm{...E,.i?.5..........)Q......)Q......)Q..........................................)Qj.....)QT.]...)Q......)Q..B...)QH.....)Q..B...)Q..>.).)Q..J...................;........4...4...4.."...............)Q..)Q..)Q..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........)Q......)Q....#.)Q............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003K.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 60 x 336, 4-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):347
                                                                                                                                                              Entropy (8bit):6.85024426015615
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:6v/lhPtnlx/QulkWNY2V18A6Akp7eee1VDjMHCyLezyKUX5Gp:6v/7RrIubiA6AkpNhiyKe+
                                                                                                                                                              MD5:78762C169F8B104CB57DFF5A1669D2DF
                                                                                                                                                              SHA1:9638B71B584CD636834016A635ABF8D9C0887711
                                                                                                                                                              SHA-256:E64FDCD0B108737D8B8F7B677029F924031D6BBAA50585D9C3DEF7C7E92ECAF2
                                                                                                                                                              SHA-512:5ED899AAF73B72DEC32E171FFA112382667D5BF3FBA98C92E313E66C0A6975EA97068F4CD32B62283F18DBD5345C11E3610F7EEAC2F2DE71FC44593180B9CEAC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...<...P.............PLTE......................=l......bKGD....H....cmPPJCmp0712....Om......IDATh......@..aI...B..C..l...^.%.`....>.]..|0.....a...hb...0......q.......p"....;...K..x=...p...y.yy~J....|...\.......y..X.......'...>1...Ky..f....&........N`..f0..b...3.......`Z.3..3.....o.......4.&........SV...4.....IEND.B`.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003L.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.350798585539876
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:k7seMJkj6HJ/XEJXY9+iMRQy8dcJgF8er:8seMJkj6p/0JXY9+iMRJscJgF8e
                                                                                                                                                              MD5:8355163E42434A7FBDA55219772FBA25
                                                                                                                                                              SHA1:A6DB43D3B88268F90E2DBB0C4326DC9532BA22B4
                                                                                                                                                              SHA-256:D7C460342F321E20735353AF2ECA5D3E927C076016B3E3AD08E8D6D2FF115C02
                                                                                                                                                              SHA-512:28173A6829679BC0211AD885B56E18DF56CCC19B2E604A15356F58A74BB3B7F26ABA16FA6ACE11A3D7B362E4A88A1615067F3655DBF185CB65A6A27F648686EA
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z....................................Co.z....<k....I.......I.qk..B.....LZ..Co.z....<k.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............{.f... ,.Gy=C.....N...^................i...C.E................f........................................I.qk..B.....LZ..............{.f... ,.Gy=C...........{.f... ,.Gy=C.....................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4......................#..............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003M.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 40 x 617, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):827
                                                                                                                                                              Entropy (8bit):7.23139555596658
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:6v/7Hs2NwBW1mtjeSfaTHHy05riYUtr8y8PQvPYzzg979Reip0QPqc:oOsotazy4rStr8y8PQIzWea0Qv
                                                                                                                                                              MD5:3E675D61F588462FB452342B14BCF9C0
                                                                                                                                                              SHA1:86B62019BC3C5BE48B654256B5D10293FC8C842A
                                                                                                                                                              SHA-256:639EADAD468B6B32B9124B1F4395A8DA3027FF7258D102173BA070AE2ED541AE
                                                                                                                                                              SHA-512:E6EA855B642ED36FA82F8E469A826DC57EB0C36E307045FF8D166F67AF9242C87840833BE31FBE4706DC54100E999D6A3D3A78D0633A3114735818874AD34758
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...(...i..........`PLTE...................................................................................................bKGD....H....cmPPJCmp0712....H.s....qIDATx^...0.Cg.;......@j..2c.=~KP.[H~..@..8...?U.g.n.a=.=.).....3..u^(.....L....5..........8.}..T.f.n.a=.=.).....3..u^(.....L..r....s..8.....W]....,..9..G?.a..`c.z...E.p...)Y.P.....#....@9.7].....,..9..G?.a..`c.z...E.p...)Y.P...`b....0.b.+~{.Pu...1..<..0._.l.@O.y.(...V3%..J....s... .(g.+.qyWu...1..<..0._.l.@O.y.(...V3%...%R.L.Q..x..R.<t.o......7.............:/.E..j.da@i..`b..Z......u.>.?...7.............:/.E..j.da@.Dj..9.W....s. .....:.......L...">w..7... .....:..."...L..."..a....D..Ya.l....E.{.@&.|.._...7..D..Ya.l.....{.@&.|....0.J.."z.0s..s....=g ..>........"z.0s..s....=g ..>..l..1...y..g......IEND.B`.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003N.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.350124662365629
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:isHbefoTtGJ5ESEX24LPXn9a4orlrdQqrsFQBBX6ViDhoK6:isEoT6REXn7Xn9a4ulRQysOBfo
                                                                                                                                                              MD5:61B43C47604D0010FCF988804EA4779E
                                                                                                                                                              SHA1:F098EAF296650D8B5ABD7E95E390E954BED0C518
                                                                                                                                                              SHA-256:D7F8E1EDBD957F35EB9E0B9B19F1CF9A6ABA848C9D897AE3EE63063A5D73171D
                                                                                                                                                              SHA-512:F50C444095EE9723D0D5AC7654AE28E93F23BFD65F0399790C3EC0A8FFACD9F3E035F33A189A62FCD378AB5EA02D5488AB2637C4A204E192BFDF19C903D047FD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.1.......1.[.3.2l....y.1.[.3.2l....y.1...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............K......$.t..E.....N...^...............,[.....I..,.^.O........f........................................I.qk..B.....LZ............K......$.t..E.........K......$.t..E...........1.......1.......1...........................................1.j.....1.T.]...1.......1...B...1.H.....1...B...1...>.).1...J...................;........4...4...4.."...............1...1...1...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........1.......1.....#.1.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003O.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 50 x 600, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4410
                                                                                                                                                              Entropy (8bit):7.857636973514526
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:E/pQuIhKZ7u06dICH3AroiTe8DGTl55poBUmLNjpH7MvDHjfm:MpdZtPbknnRPpkLNVMvu
                                                                                                                                                              MD5:2494381A1ACDC83843B912CFCDE5643B
                                                                                                                                                              SHA1:98F9D1CC140076D1AE5A9EA19F47658FD5DF0D66
                                                                                                                                                              SHA-256:5EEBE803E434A845D19BC600DF3C75E98BB69BD0DE473CEEC410D1B3A9154E28
                                                                                                                                                              SHA-512:0E64CC3723DC41D94910F7ADFB6A0DFB5049350FD15A873695614E4A89ABD78B166BA4E9C8CB95E275FB56981539DECD2A7F28FBC25E80DD5E2DEA8077CC9489
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...2...X.......E.....PLTE...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................B..(....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.].\TU.?3"...(..L........q.Q...H.*j......W..Xd.ie.f..%.XT...em..m.m.vkik...>.}..}|..{'.U..~......}....s.............,CVu.x.:C..5...;.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003P.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.322608657520438
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:Yu9Us7O9e0zeltWxI/EZUncf0LTKXBkzrNK9yYFoFrdQqrRVABXwapuf71ipOTIG:YlsozelV/EZnf03KX4xK9y+kRQy0w
                                                                                                                                                              MD5:C82A6D925DC828B0E561C18E8E353713
                                                                                                                                                              SHA1:04BA3480BD807B3ED933D5F11FE30512409CA252
                                                                                                                                                              SHA-256:6BFFF74EAD621555EC1C32E76FD4D48CD7924A099F3ECD5412F0EF5F13FD3A2F
                                                                                                                                                              SHA-512:6FE93B58D5EEFF836DA7B2365817F3C01A48F525BE652281BEFB3C4A3589339E338EA43C7EFB845EE7E9C841C420BE82227693DE05C4D0894FBDA96C83D50486
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ.V......V......D...PD..V......D...PD..V..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................!....O.......N...^.....................VO...B.S..........f........................................I.qk..B.....LZ...............!....O..............!....O.............V......V......V..........................................Vj.....VT.]...V......V..B...VH.....V..B...V..>.).V..J...................;........4...4...4.."...............V..V..V..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........V......V....#.V............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003Q.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):136726
                                                                                                                                                              Entropy (8bit):7.973487854173386
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:SIXmy5Tl704vW2ZKkvV8UU0ZWUF0BJwySIdgz816YzDc1+opecYPn:Sny5Tl704fZFV8UU6LGXwyS4xohpQPn
                                                                                                                                                              MD5:4A2472AC2A9434E35701362D1C56EDDF
                                                                                                                                                              SHA1:16FA2EA2D2808D75445896E03B67A93000EEDDD8
                                                                                                                                                              SHA-256:505F731CB7707EFAB2EB06685B392DC7E59265A40B55AAE43E5DC15C0A86CBA4
                                                                                                                                                              SHA-512:5E28D8FB2AC62ED270968072A30013334461F7CAE96058AF9EAA6E10912989DC47112D2133892BF61F7A516B77C6FF71BA2A000B750A9F95C787E538B09595C2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQaq".....2B....R#..b3...r...C$...X.....Sc...9.%'.(Hs4Dgw..T..5GW.x.)......................!.1..AQa"2.q.......B..#c........b6.Rr.3s$.&..S...C4.%5............?.........(......(......(......(......(......(......(......(.G/.GE&...)..P.x..B.({i2Y;.z?G...Yfc.)H..^....#.....}3..Sc^.H..+...M.a.P.....GS.....H_.3..<....1f........1.<.\..nn-..s.s.\9Y....=.......S.0.......N..cA..Io..r.3..........ay.....K.....,.;9..Q......xO.Fa.2..>........{4k.....|....?U....3.8..._/3....#.. t.y......yY.......e.<........#.....B.....Z.%.Y..S.ye.W4...l.......X...%.@y}>....l.yi..D..W......L..._D.Q....)...E....n.%...*..K.4#.8`..I....h..h.o..I......-...hB...3..u.(5..........n...,.@....a.t.9.....@.s.>.&...@

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003R.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.3304472737872945
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:nDisP02YWY076QtNAjEKHL/1XLf9/q2dol7rdQqrWIw0BXFC9j9LJN:ese076QUEKHxXLf9/qG8RQyvw0TCd
                                                                                                                                                              MD5:7D63445C61641C68029973C46A634697
                                                                                                                                                              SHA1:46F054B9A7F339F4855FD2A7C433912A610C3BA4
                                                                                                                                                              SHA-256:34591E241CEC1B13D927EAE12617630E3FA83B8FBF2D0A355C920EE413EA7527
                                                                                                                                                              SHA-512:F8F1160CB357E4E4B993E7C2DFFB94366DE213886D3078D9A9B3CDB53A71B177519FAFD34FD646C4DD860838F5490DA98210693B5990EF93B276178BDC4B1EA5
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ...........Y.*.".r.e....Y.*.".r.e......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............1.8X....$.E.......N...^...............{%u...G.5.Np.}.........f........................................I.qk..B.....LZ.............1.8X....$.E............1.8X....$.E...........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003S.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 77 x 627, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):5136
                                                                                                                                                              Entropy (8bit):7.622045262603241
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:djzuNKb3XHco17p2wolIxIx7lpskdsC/ddWNKeabJbMojpxLDTu1:VzuNKb397pwlIxKp7qs3bJb5FBTw
                                                                                                                                                              MD5:FA38AFA965141EA3F17863EE8DCCDE61
                                                                                                                                                              SHA1:2B4611E651AF7549C1AA73932B1136B561A7602F
                                                                                                                                                              SHA-256:E1CB1A0EC9BE62D5445C73AA84DF38234002A7E164EE830C9DF24997802CB5D2
                                                                                                                                                              SHA-512:A372674F5CA343321BA9C413D346070709F7685706C9C6C3DC7F61846B59253A5E6FE800DBA10AE870FD3887439B2AA106FBBB51751E92A163938A4393C43E28
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...M...s.....}8nv....PLTE.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................z`.....tRNS...................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003T.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.452246894021779
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:zW6stW0e2atS/sEBvZXkHR9G6otrdQqraYBXsA2nYq/t:hs5e2aVERZXkHR9G6MRQy/h/6
                                                                                                                                                              MD5:5540DC162E81EEA419C811847C28AA0D
                                                                                                                                                              SHA1:D8C08727E3DD25501823ABC7640DF970AD4A72FA
                                                                                                                                                              SHA-256:3BCA69D48BB80E2FC228C30FFAEF4A6ADC5C9E799BAD8F5D699ED2B742136A8C
                                                                                                                                                              SHA-512:63E84ED042B23618746D4224E6FF0C244336F52E746271ED1C6BED9CF4721B15A983F6E0202D992C23F5B34AA977497D231EA69942C3B94382CD72699451B113
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......h...v...\...................................................................................................................................2...>...D.......v................................I.......I.qk..B.....LZ..g.......g.....&....2....g.....&....2....g..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.....................t.tL`<....N...^......................C..c.$..j........f........................................I.qk..B.....LZ....................t.tL`<................t.tL`<...........g.......g.......g...........................................gj......gT.]....g.......g..B....gH......g..B....g..>.)..g..J...................;........4...4...4.."................g...g...g..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4...........g.......g....#..g............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003U.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):52945
                                                                                                                                                              Entropy (8bit):7.6490972666456765
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:cjvqR0XvFaGCTJffi0tgybmWDoTw71kHUAnjvawrlp2+NUO8dWSNl3PF2PjK/q09:cyRffflgybmWoTw1UUADHUbU21MjpAD
                                                                                                                                                              MD5:AD003F032F32FAC4672D4CE237FA5C5B
                                                                                                                                                              SHA1:AE234931B452F0D649D91291763B919CF350EA49
                                                                                                                                                              SHA-256:ADB1EBBE18D6CD8FF08AA9BF5C83CDB83BF9AA179698E34E93DBCDDE12F04D32
                                                                                                                                                              SHA-512:ECA25FA657ECE3A66D3E650628E0F65D3BADD38864C028AB6553950A1A66D7D55482C85E9E565573E9E5AAFA91C2D53235971C644A266D41EB69F8E72E3A843B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQ..aq....".....2....BR#r.b3$...C.Sc%...s5E......................!1.A..Q.aq"...2...#...B...Rb3..$..CSr...6............?......y_N.e.H7?........W..w....k|...S..d.4.>.RW5z.$.i.)V.O....>o...c..*&1.D..O..".ufbb..1...t..u=..K...m...~.....F..-.fb:i..=f..C.w.[{..~.7k....;..:..3....4.....$..m]...}....~q...9T.#..7.~..8...q.N;c..ffo.w...W..d........../t_........lWJE..).>..v;:=....Rrw#.m.n.n...E...vm.J}2N*..|.4...80.#..e....t.J..ZQ.x|g/....F..e....k+vK...M..W.X.e.L..~...j.....kz....=...n:O.:..[.L,.+R...Y..zKNI....,..{e..U.'...}.......|..t.]...~...b4......_.i..../.......m...a..n...v.j.?..Rc.$G|.31..#..$?.........h.w....-... .a.%z..u......u.A....Fm..J.......G..[...w.....:....w/.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003V.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.430694736286397
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:zWd4sv7X6Q6owtAyuKEbL+XXQXyaN99Z8P3ZrdqrbUb9cSQ6BX6Dgt2wXkh:g4sO7owV5EbxXyaX9Z8PJRyopc+asu
                                                                                                                                                              MD5:36281482CD00FC78C02D16FBB3AD3ED6
                                                                                                                                                              SHA1:A78889586CDB3CDF26772D3E29E374FD6A099AD5
                                                                                                                                                              SHA-256:C8A4D1C8B4B87BE815918EAC4208EA959EC96A928B16889803D38579D043C7C2
                                                                                                                                                              SHA-512:EAF2914783487B456BEB096B1FE9D5B6C098732EEE45BFC092F1EFFCB336A977700EE4C1A33F162D8833D430180B82E1F3ED02A52945A60E529165A68B6A1436
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......h...v...\...................................................................................................................................2...>...D.......v................................I.......I.qk..B.....LZ..&.......&c..n...i..p.(..&c..n...i..p.(..&..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............;t...%.!.......N...^...............'.V...$L.o.............f........................................I.qk..B.....LZ..............;t...%.!.............;t...%.!..............&.......&.......&...........................................&j......&T.]....&.......&..B....&H......&..B....&..>.)..&..J...................;........4...4...4.."................&...&...&..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4...........&.......&....#..&............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000040.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):79656
                                                                                                                                                              Entropy (8bit):7.966459570826366
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:2kuUliOeU4os8ii3nF3Hxro/qxXD9u/kjYgMZqoEs6ZUldm:3uUsOXYIAixR2k7WAZV
                                                                                                                                                              MD5:39FF3ACAE544EAC172B1269F825B9E9F
                                                                                                                                                              SHA1:2D40DE8D90BD21D56314D3F99CEF4FBAE3712C0F
                                                                                                                                                              SHA-256:70475431CCA3C91A4EFA3B8F04864371D2D3A45696674A1A0562FE9CD8DB287C
                                                                                                                                                              SHA-512:3B9F3B32696AB7779864E83DC0C45960114A130BEE0CF4D0643DE57FF952171E5D775AA49141EE31A28A9B5D052B26EB421F26EA736D7EF4B3A7EC812CA411CB
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!.1A.Qa"..q.....2#..BRb..r3$.Cc..Ss.4...D%5&..T...'7....................!1.A..Q.aq..."2.....B3.r.#..R...bc$4..D.s%............?..Y..T.o.\......=.a..j..'^..s..[../........Y.......<...(..4.....7y..Ln.[9.cK.ilN...u@$.V.9.V?3..s.KL.z..w.jW.C.............@.~+.o?o8...k....,.m..9.".....q.....d....z.W...q...~...'..e..>..f#...S.....F....pU.......7..N.vfK......S..G.#.....}.c.........RXt.bq1.`.....[+8\.*.N..:......}.....r..........')......Na...&...m......c...a4_%d.............co..0.n.L.Q..E.Lt..y.|..F..4.i(>.._..\.eNL8..?z9I:hLgC.@.p....g.t......'.I!d..?1f..R..........|..4.wJ*..%g..~0bt.....*...v.......O...:.~.>~..o.x...9.@>...s.&.E.0/G.c..t.<..F.t.A.z. ......;.........Gp.P

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000041.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.470229942961725
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:8sOp8P6K7D+tcd4EWnNql1Xxi9XFoLZrdqr24GhzFRXwM4VfHtn:8sjP6K7D+SuEHXxi9XF+ZRy244JUH
                                                                                                                                                              MD5:03DA28BB68A1D1EC78A32D4D4F1DAFB8
                                                                                                                                                              SHA1:907EE3E101FC449C54EE68A6FA16822FB09A4C4F
                                                                                                                                                              SHA-256:A4A270BB862D1221C8682B3B1626DDE306E3E3BA4ED250B1B8AD582A7C1979D0
                                                                                                                                                              SHA-512:70217CED3C3597A4406819CDED74A635E12DBC713E477706E40CE35C798AB00CA83F3770A4C44233E5DFA6F3B566B06D17510771A7560731DB0B9E79F31474D3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......p...v...d.....................................................?....?........................................................................2...>...L.......v................................I.......I.qk..B.....LZ...........b....g........b....g........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.......................0+.......N...^...............y...9..F..f...J.........f................................... ....I.qk..B.....LZ......................0+.....................0+.......................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4......................#..............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000042.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):40884
                                                                                                                                                              Entropy (8bit):7.545929039957292
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:MCBOA4d+ElOXJ/3pI7cRBiL7L6qERqGz65WXzZqJsKQSbIsTT6XB:hIAU+2cGdLX6qBG4WDZl4Ihx
                                                                                                                                                              MD5:7379775A1E2AB7FAB95CFFCE01AE05F3
                                                                                                                                                              SHA1:3D3DDFD8AC7E07203561BAE423D66F0806833AB3
                                                                                                                                                              SHA-256:9301DB6D2D87282FCEE450189AEACE16D85F64273BF62713A3044992B6B7A9E9
                                                                                                                                                              SHA-512:4B5006E620E80D3A146944649CF4CA619782CAD7E8C4CD0D1DE0EBCA0FA05EACB7378DAFCEED3E26F5698B07F19604614D906C8F51F898660E2F129D8DEC6F62
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1A.....Qaq....".....2....BR#S..br...3T...C$.7(Hx....4D.G..Xh.cs..'..t...%...8.....................1...!AQ..a...q"2.4Tt.......R3S....Br...#s...Uu.bc.de..$D..6..C%E..............?...z...;sB.yv...........]t.\...n...../....m....M.=.3G+..x+.....S).*&.J../..8..O/+..sG...p...<!....~.c..C.w..,[oHom.wc-.J.~.......L[..6...'..i_..S;...!Y.z.q].EK..M.x...i.x.+.;.+...}....#......f.)........e6V..p.;........s.)..Ml.J......IU.6...<9+9.^..l..Y...[._...2..^..j.ia...._..3.;...~..<3...;......z.^.......]..Qk.,...Yk...3.3Jy^p.}....q...I...&..t.......;..9.g.GH;..'...%...)..[..y..../...zCn..>...'...1e.Y..;....]..7...N>t..m-.j.............H^..T\.q.ru...}...eTn]I'r.^].#..wOY....v

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000043.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.337025580747541
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:YlszanFGwP++En+jXk9zwgRyVC4FuCWVaTK:mszanFGwP++jXk9zwgRyM4FuCWVa
                                                                                                                                                              MD5:B31C45F207674D1E48DB4C864906580D
                                                                                                                                                              SHA1:7637084E65C0314B12B18D7367300B3B74437341
                                                                                                                                                              SHA-256:1C2A498DF26BB3F36FE9437B2C90390B4FE00E8FDD6DD943DCFE72EF319366BE
                                                                                                                                                              SHA-512:B8DEC0E7AE4F6017F9972418D054A0BF69D7C2959A925653052204025212223BCA307828CF8020BAB38E3844BCD9ABF05658C5BB4CAC9F70B0D59433378C11C1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ............3............3.............I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............h..1r..7",.......N...^.....................<A....... ........f........................................I.qk..B.....LZ............h..1r..7",...........h..1r..7",...........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000044.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:05:55], progressive, precision 8, 612x618, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):68633
                                                                                                                                                              Entropy (8bit):7.709776384921022
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:tapXpSTJDOkFGdJdBk/slsbfsw1imaapnbvD8:U2OjJr6b07m1bvD8
                                                                                                                                                              MD5:41241EE59AB7BC9EB34784E3BCE31CB4
                                                                                                                                                              SHA1:98680761A51E9199CF3C89F68B5309FBEC7EE3CB
                                                                                                                                                              SHA-256:035B26DF61855A3F36DBD30FDAB0C157C04C9E8AE2197EA4D4AEB3E82E6A4C2B
                                                                                                                                                              SHA-512:3EE331D5BCEE4AD5D3FC9661D4AB4053F7D351591A094334F963C33C9D0E32CCCABE9334AD7C308108CE99617E064FE848DCD469ACD8D83FBE5C4452DE523D8F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:05:55.............................d...........j...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?../$.W:SZ./...9.....-...u......r.....].c...@W_.7...+......v.+PD.I..-<1.pDn-\.....p.$....0.}V....\..>.~..XN.o..l(E....ik..o.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000045.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.429238303850009
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:5Gshvl3phWDEg3emXJX5W9T36oRy7ca+fZw:5GsNdpTg3emXJX09TKoRyGf
                                                                                                                                                              MD5:F092A35E28519E651BA97152E437879B
                                                                                                                                                              SHA1:90BB1D71C413D3E8EE5D1CDE906CDB1A66E3F7B8
                                                                                                                                                              SHA-256:B9DD1632CD7A0697C491AEBA5EF781E34FB253A60211270210E5A8D987310D5F
                                                                                                                                                              SHA-512:42E81E557E39B2DF5DAF54AA0E87DDF55B46652059FBE79CC400698D20999A31204EF47D241DC7C375BC1D7BC910B3517DC35A639D38007AC6E2F01F56D7C629
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......t...v...h...................................................................................................................................2...>...P.......v................................I.......I.qk..B.....LZn;......n;...R.*J..G..%n;...R.*J..G..%n;...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............cS.. ...@nsQ.......N...^.................s=0.yO......I.........f...................................$....I.qk..B.....LZ............cS.. ...@nsQ...........cS.. ...@nsQ............n;......n;......n;..........................................n;.j....n;.T.]..n;......n;..B..n;.H....n;...B..n;...>.)n;...J...................;........4...4...4.."..............n;..n;..n;...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........n;......n;.....#n;.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000046.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 176 x 513, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):11043
                                                                                                                                                              Entropy (8bit):7.96811228801767
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:YyroOCsBI9pkCFsHHX2RE6VOlPuIqmBtJNBfAr+ADP1IATaNeTyZ4GF+WQQ6Qwq2:BUOCsB2kCGH32RiPDtDBfArPDP1I/eyM
                                                                                                                                                              MD5:8E9AB9C28B155A66BC5C0DA5E2A4EFB5
                                                                                                                                                              SHA1:972E61F162D48F1CEE21963ECBB2FE439105DB55
                                                                                                                                                              SHA-256:B243A24FA13BC8523450E22F408F9EFF15301C938F8CA52A57018B58CE6785DE
                                                                                                                                                              SHA-512:12062D69E676B3B34AFCEF25AC17B40294282D5BAB6C0110680293D7CC96EC17EBCFE104C284E64A30EE3C483E319E9C37C03F6EE82C79632180E45C7A684E8C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR..............`....`PLTE............................................................................................... .......bKGD....H....cmPPJCmp0712....H.s...*YIDATx^.]...,.N.8.i......0..e..y.......8.6....Fo.........=...F..._..........O..{..............3.|.L.|.............>.....v..n.1J...k...."....7........J._.5LQ`..k...._Z.W.x:..k...g..._.....u<.Q{...1...q6.cs...l............30.g...< W...a.5..>O....9}..c..........s|I.).>.fo4.<q......>...c.:.u..co.#.7,.O..G./.K.|..q.p...(.(....iH.......m..+.7...../..{W.l....b....?.`^.q.9L&.>.hN2`1..m...]$.0J....rBy......{.._...G....;.r.Q..;..,...9..F...t;.+..2.Ub......V...8.k..5.........'[..s.H..).......%j._.&.....BN..V..q...T...#..........0.E&.o7....$..m..8g.f._$..k.8...5......HgQ...L..\.........)B.I.r.(..8.a..$N.9.=..o..Q..(.e.a..O.....c.= .......$0..X.S,..(p......$..l.c.I...=."......g....^..#~,&.a9iK..ZNE`...pFJ.@Wd?.<..Bt.E.......e...i.%d...}.!..B......9.........B}.....5...;..hL.D.....4z.....|.)

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000047.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.349062499884562
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:osHM9MlLGGEQyX/Jm9jL0ZKRyEYFrBdYF4JO:osHM9MlLWQyXRm9j4oRyEYFtdYFSO
                                                                                                                                                              MD5:D15643E1FC72F8EF0BDCFA51633FDE9E
                                                                                                                                                              SHA1:71311DBFE2CF697D752F7BE43E76578B27A2BDBB
                                                                                                                                                              SHA-256:F7A031ACF39000C7794097796C1F55C694A213EA14BEA60109ED23CA4993AA74
                                                                                                                                                              SHA-512:86DC09CC40BE5EA038DDF2DC2E2FFDE83C864F127409F017480F8A34B33B1A97390B3DC8FE4260B63A4A6FC136BDBC47D7E629D4155F1C3E1A5A74AB31807363
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.|.......|...I@...l...u..|...I@...l...u..|...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............b..-#...)..f........N...^..................za..D..L..i..........f........................................I.qk..B.....LZ............b..-#...)..f............b..-#...)..f..............|.......|.......|...........................................|.j.....|.T.]...|.......|...B...|.H.....|...B...|...>.).|...J...................;........4...4...4.."...............|...|...|...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4..........|.......|.....#.|.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000048.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 40 x 650, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):647
                                                                                                                                                              Entropy (8bit):6.854433034679255
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:6v/71rwqZMXVs99W1YvpLp/Fvl+f43ocLtuplb+CrGotLRd:+wqWXVs99rpLpNvr3pIx3b
                                                                                                                                                              MD5:DD876AA103BEC3AC83C769D768AD39FB
                                                                                                                                                              SHA1:1833603AA9B6A7E53F9AD8A336F96CCE33088234
                                                                                                                                                              SHA-256:1262DD23AD54E935CFA10FEB1BE56648E43BEF1116696CA71D87E6E033B1CA7D
                                                                                                                                                              SHA-512:946DB2277213104A3B29EC4388578B05027B974A3093B4CCAD8847397AA51AE308BC6A199E5705E1F901D6E4B1BA34D8DECFD6E5B6685184A307D749D7CFAEDD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...(.........xk....`PLTE.........................................................................................>.S.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.)..1..7w....6.*.H`T6.ha.k.............b!....Ba..C..P.4K..@.....h.E..X....PX+.P.-.....@@"...o.O4....xZ<...B...B..,A..y.s<......b!....Ba..C..0_p. .......=..,...i. ...=.j..N...........{4+...xZ<...B....|.....$.K<.vyE..X....PX+.P.-.:... .'p......\,...i. ...=.j........K.....%J..S+.....q..k.H.@DD.s...:..J.K.DDL.\.@`,.DD.:.(]..N....KD....A M.....F..S+.....1.sq........\.t..;..../...~k...4.DD.:..]..N....KD........@DD.s...:..J.K..[...Q....V......IEND.B`.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000049.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.361825077362833
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:ysJEyEx28b+PmEjFFpXbfp9Tg4RyK9dqey7jXxQY:ysJEyE7ixLXt9Tg4RyK9dqey7jXx
                                                                                                                                                              MD5:58CE3D6814AEC284F313249169D007F2
                                                                                                                                                              SHA1:0296B9253977897DF277D2BADF06B41F72303AEF
                                                                                                                                                              SHA-256:CB9406A38578E8723D4152ACD660EB86345C89DE2EE7CA40FE68442E87AD2422
                                                                                                                                                              SHA-512:D7B7FECEE954DFB18E7F120F3E8606F052EA96DA1B77C609933FD06321E0936C699C0BFC5A46DBF8F8A0553BE3CA3DD0C906BA08C4818813F1C989A308406784
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ.d.......d...M:........d...M:........d...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............+sx-1......(.%....N...^................<..a.RH.....o..........f........................................I.qk..B.....LZ..............+sx-1......(.%..........+sx-1......(.%..........d.......d.......d...........................................d.j.....d.T.]...d.......d...B...d.H.....d...B...d...>.).d...J...................;........4...4...4.."...............d...d...d...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4..........d.......d.....#.d.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004A.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:27:10], progressive, precision 8, 102x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):52912
                                                                                                                                                              Entropy (8bit):7.679147474806877
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:DB/nIviNJD9C8kfJj6TkVr4q24FsUpjPc021si:DdnIvi3D9C8Cl6Dq24ayPCz
                                                                                                                                                              MD5:1122BF4C2A42B4FA7F29D3C94954A7C9
                                                                                                                                                              SHA1:3750077A830FE21735A43ABD35C63BA9A4D4B0DE
                                                                                                                                                              SHA-256:423B0DD1A93B391D15B1DC8D8757C3BF5725FF2E7A59E6E3140033E2876B67F6
                                                                                                                                                              SHA-512:4626EFE2EDED2361D6296B57F994DC434CC9D02357A8A6A67D84A544FB8A1CFE0005EA98F846AB963BED7F2B6CE96BC9181182C9459843A52A98D3A731A4FE73
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:27:10............................f.........................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....]+\.9.9.P.d..Z.?~>.-...]6=....*.......S.9G...b<$..Z..........>.v.o:.o%.e...z.F`...[.wo..z.....k..E...5....G..7.......c2..

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004B.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.340010488845736
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:mBs4PDK/MjmTDzjt3Ko32QEkYrVBXnH9TAoRrdqrPDKRXfJEMj1ZwuuAgdDYV:mBslzjVYQEkSLXH9TAARyOjtF
                                                                                                                                                              MD5:F08FD5087F2368B5F80C0F786FAA3AF4
                                                                                                                                                              SHA1:E5DA9F7E99C8FA5904AA173D89D57DAAECF1A8BB
                                                                                                                                                              SHA-256:EF238D5BC1C523E899501010BC1280E877D11B960E768E366CB9F3E2C08E77D0
                                                                                                                                                              SHA-512:620ED3FA60440E306BB234F5E703F4C4FDE7DEC31FFF67432E682127876DA887F25641519E2CF7CAF5F04F36A43F8FFF34B45DAE2E607FC47D41E94B7C621A01
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.X;......X;.h...3.h...J.X;.h...3.h...J.X;..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............LA;EY.+.i.........N...^.................Z.y.SB.|=....i........f........................................I.qk..B.....LZ.............LA;EY.+.i..............LA;EY.+.i...............X;......X;......X;..........................................X;j.....X;T.]...X;......X;..B...X;H.....X;..B...X;..>.).X;..J...................;........4...4...4.."...............X;..X;..X;..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4..........X;......X;....#.X;............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004C.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:18:09], progressive, precision 8, 164x641, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):27862
                                                                                                                                                              Entropy (8bit):7.238903610770013
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:LTawAZvhbrXzDc6LERLQ/b5vXOl6pXQ/wD5OUMrdRUUhCplQg0ESSz:6wm/vT/b4wxoqbdUhWnSs
                                                                                                                                                              MD5:E62F2908FA5F7189ED8EEBD413928DEE
                                                                                                                                                              SHA1:CA249B4A70924B73BDA52972E9C735AEC35A0C5D
                                                                                                                                                              SHA-256:20ABE389C885E42B6EBE9E902976229BB6FD63C8C34CB61AA70B8B746209F90A
                                                                                                                                                              SHA-512:EE8D1821A918BE8714F431895E7223D08036E88A4FDB9A5485EFF246640EE969A69A8AA4E2E9DDC35BA75FB6D4E95092A286E90B477BD6998C313639C2C31F25
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:18:09......................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................!.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..P.v..+..n(a..Q..S\6....Y....D......} w#.b..]l.5.RU..k...... ]$.$.........f........?.z@2uU...7....?..|.Q..I.&.. ......"T4)wdH.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004D.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.501049433601254
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:DiBsA12VYMtbYaJE5z4muXrf9XqoRrdqrfbPZRX9GNEitJV:DiBsfV5FE5smuXrf9XqARydE
                                                                                                                                                              MD5:2FDC085427209A86309B4B92CCE01F76
                                                                                                                                                              SHA1:B33105B41A9E19153F42B87EC801EEAEF4A79A7C
                                                                                                                                                              SHA-256:9BFC40BB2BC0CDF0ED9CF8920D578B0747B2ED56F7C1F45E5295B21D52E4AD6F
                                                                                                                                                              SHA-512:AC170F5952609EA6574EFF5AF27EB62D15AC57636CDBE9526B2661E7DE30FEB682FF4E51B47C6241706773FAE564692D004E199E9CA0265C49354AD90B46D8B9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......r...v...f...................................................................................................................................2...>...N.......v................................I.......I.qk..B.....LZ.P.......P.9....am.w.7..P.9....am.w.7..P...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............V.../.W../......N...^...............},....oA.....o.........f..................................."....I.qk..B.....LZ..............V.../.W../............V.../.W../............P.......P.......P...........................................P.j.....P.T.]...P.......P..B...P.H.....P...B...P...>.).P...J...................;........4...4...4.."...............P...P...P...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4..........P.......P.....#.P.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004E.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 50 x 556, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):977
                                                                                                                                                              Entropy (8bit):7.231269197132181
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:6v/7QiFJaY/z+obuqFA4fypjQSbtBK+lcqNGSbb7XTJArRRzN5DjNRkPmu5cCbR2:x0QY7xbjy9pY0JPXLTWroeuCCbX0
                                                                                                                                                              MD5:B7F74C18002A81A578A4EE60C407A8D3
                                                                                                                                                              SHA1:70A7D4BB1B3ADF4397D168AD0D81B286F88EBDE0
                                                                                                                                                              SHA-256:95F59A0433050180D4C0E8858B83363D51BEA6752A8B7CA516A8677854D8F5B6
                                                                                                                                                              SHA-512:13186A7CDCE80BCA9D2238666D6D7A989FA1887EABFA5D8A9A63EEC304DFD4BE8EFF652205FA56E1D1CEE7D3680AF8C70A952AF73AB3C246400E8D4EBECBDBA9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...2...,........A....PLTE...................................................................................................................................................................................$.y.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^...0.D_.......cck.....%a...X.a0Y...-..!.G...[....(.r.H.$...1 .zq.4V.e|a.6.X..4..kl.%....=w....6..TN.....{.4..T/.z...../.....3..!~..t.#b..^.....E!.SFb ...-.....^...,..C.!.b...i._c...s.X.w.. lsQH..H.gKc@@...i. ....m...;Ci....@G.; V{..lO..\.R9e$..{.....P...E.+.2.0D.B,..P...56.?......K.6..TN....^z.4..T/.z...../.....3..!~..t.]b........E!.SFb ...-.....^...,..C.!.b...i._c..Y.O...?.9k2.M.?5 .n.P...,...d._..%M?....6....,.1..R.4.a.R.+..U.Q..P...vd..T........j .]@....."..lJ../.90.4...Y. ...9.%...{......Hc%.....i..%M?aG..H....o.q.......4.......X.d9.r..CI.O.5.Ri0?.s\b....w...>/k..4V.)Y....P...vd..T........j .]@....."..lJ../.90..2..MP..l..?....K.X.....IEND.B`.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004F.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.353753459191781
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:gBskSkcSaZtI9IE3VpLlmXk9Osu6ooMrdqrgHrJnRX4U9865:YsAaZ6qE3TEXk93l/MRygBl
                                                                                                                                                              MD5:2343A21110F97ACE3947E26EA47AB940
                                                                                                                                                              SHA1:3EC7F3860A5C86924810E8F7456A5526A859E623
                                                                                                                                                              SHA-256:25AA27BD00D4684E9DC302EE5ED02F13D5FFAAB289ADD05D3B50D686EC3583F6
                                                                                                                                                              SHA-512:52752EEF1B907A9C5EB9FF361E436144B5789076A033ACEDB00D48199E448F925395890444351E4CB5329882C441136C9E794DFD1193B6696EEDDF36D988D856
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ%D......%D..`&[.9....n-q%D..`&[.9....n-q%D...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............R...s.# d..z......N...^...............x.F...gI..}R..e(........f........................................I.qk..B.....LZ.............R...s.# d..z...........R...s.# d..z...........%D......%D......%D..........................................%D.j....%D.T.]..%D......%D...B..%D.H....%D...B..%D...>.)%D...J...................;........4...4...4.."..............%D..%D..%D...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........%D......%D.....#%D.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004G.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):34299
                                                                                                                                                              Entropy (8bit):7.247541176493898
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:BrSX4V3P8AIc4KLkHeXRUer0zrhOmXfvG0yH82I:tSXuIc4K2eBtswKsHg
                                                                                                                                                              MD5:E9C52A7381075E4EBC59296F96C79399
                                                                                                                                                              SHA1:BE295AD24D46E2420D7163642B658BF3234A27EA
                                                                                                                                                              SHA-256:D56CEFE9EE2FAE72E31BDBA7DD2AA4426EA22E3CEB22EF68C8F63F9F24D5A8BC
                                                                                                                                                              SHA-512:95CC96DD4459EBAE623176033BA204CCDC50681A768F8CBAE94C16927D140224E49D5197CAE669C83C77010C5C04C1346CF126BEF49DB686F636C5480342A77F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.......................................................................................!.1..A..Qaq......".#4.2r3.$.%...B.5U&6....Rb.Cs.7..cDTEFVf'...S..dtevw.u.........Gg.....................!1..AQ.aq.2....."#3.4....r..BRb$CS.D............?..5..............#....v.q.m.}\..{....;...r....h.....J..q|..'.;\..6..v......e...../.k..|.8..i..|..]..3e.m....n..Z.GS..n".y..w.-...[a...7A.....i.4.)9\..~C...=.........s..\V]c.D1<./.g.l.&v..~.h..]....zb>G..y:vNS.\......LU....t.{*..Z#.?..v-...wn.rR...P.....y\=.v....../..9_...m4...V.|.+.o.#.......xj....}..>.s.>C...m.[;.>.p...=^.i.X.(..1...{.F#N.W...xi.z...4..u[{...yO.....8..}\..2...KlX.nbya...2.&.F...R.b.k.7.GV.x.h.y\.Q..O<\>......-...=...r......\......Z.Z...Jf.'....z..Y.q>.p....o..K....h..R..c.lg?......A.Z...Y.q3.L|.'5...

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004H.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.314968390504956
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:esORtIohqthH7sAxEHSFLCXDbBt9P+otrdqrRgCZxRXVlph1LswsQ2OpDA4d:es+hqTXxEyF2Xj9P+cRy3aQJ
                                                                                                                                                              MD5:0B43A503CCAE4C5B950B0F2D67DE84FC
                                                                                                                                                              SHA1:605F4415A5D7CE989233F814A45052A0A120472B
                                                                                                                                                              SHA-256:373828240D29C4CEFFC5D99E69D08FBADC57DFB14C58E5CF628E10D081FD6ABF
                                                                                                                                                              SHA-512:C750F53D0731EDADB828666D18E146C0FCF4653584D4E343C9D4EBAC61C4B1212077B402BA39BE034C0D9B07CB0E8E95B267D8695470659B0ED9392DB4E9BAAD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ..i.......i5.............i5.............i..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................1W....Q2@Ay.e....N...^....................].F.....//.........f........................................I.qk..B.....LZ...............1W....Q2@Ay.e...........1W....Q2@Ay.e...........i.......i.......i...........................................ij......iT.]....i.......i..B....iH......i..B....i..>.)..i..J...................;........4...4...4.."................i...i...i..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4...........i.......i....#..i............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004I.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 171 x 552, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10056
                                                                                                                                                              Entropy (8bit):7.956064700093514
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:edmu1fpj5DVHuooK4EpGLbAdT+dBXYBR8D1V2p6KwoPR6KUX9ojwRpgA:2Pp/B4LbAF+dBo/1E3S6JScpgA
                                                                                                                                                              MD5:E1B57A8851177DD25DC05B50B904656A
                                                                                                                                                              SHA1:96D2E31A325322F2720722973814D2CAED23D546
                                                                                                                                                              SHA-256:2035407A0540E1C4F7934DB08BA4ADD750FCB9A62863DDD9553E7871C81A99E3
                                                                                                                                                              SHA-512:BC7DC1201884E6DAFDC1F9D8E32656BFAEE0BB4905835E09B65299FE2D7C064B27EAA10B531F9BECF970C986E89A5FD8A0B83F508BBA34EB4E38B3F7F5FC623A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR.......(.....!..t....PLTE.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................4.....bKGD....H....cmPPJCmp0712....H.s...#.IDATx^.w`......$..B....... ....fz5..6`l\.8...Nsz{.//y./....{.7}g.....e.....~.......s...f.....%c...6....O.PJ...Y.oi...9..'j.2..6.-

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004J.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.294398947627875
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:B4LszMMVVuAHaazJotdLEEXh2aLiXhFzj9bVodrdqrQTRZrRXCbVvm1a9:B4LslVGmobEEf+XPj9bVkRyQdZrg2a
                                                                                                                                                              MD5:82160B33AFAF7876BFF4789E5B14492D
                                                                                                                                                              SHA1:70C3085BA3D2A78052741B453BF7C2725B09FC2C
                                                                                                                                                              SHA-256:76C6FB81BD8A77E9934AE5B46E0C8087EEB4181ACDB517804AEF54B84E90E21B
                                                                                                                                                              SHA-512:B0B91E6E39933AF8C5C0031302A939EDA255D5F180A837E3A249AB0E4CDFD618CF68101DB6620EBC29A7638E17CAF725EEEB5CDEB567525BEAEB11326BEBB1D0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.'.......'..5....c8. ....'..5....c8. ....'...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............--..J.........'.....N...^...............d...x.AK../)v..%........f........................................I.qk..B.....LZ............--..J.........'.........--..J.........'...........'.......'.......'...........................................'.j.....'.T.]...'.......'..B...'.H.....'...B...'...>.).'...J...................;........4...4...4.."...............'...'...'...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4..........'.......'.....#.'.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004K.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:11:38], progressive, precision 8, 577x757, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):84097
                                                                                                                                                              Entropy (8bit):7.78862495530604
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:cgHTEuD99rHwA5MSadIV2MApVmfJkAKOQ/Z1I7ngpDDyHfKFVITrU:HHjXidIhApV88/jIEmrU
                                                                                                                                                              MD5:37EED97290E8ECB46A576C84F0810568
                                                                                                                                                              SHA1:18D9FACB4CFA3CBF63B882CABCF30B203EDF4126
                                                                                                                                                              SHA-256:140DD943D0F0CFE6AAA98470B7D1A7CB62CA02CB1D8F522DD2AC77433232EF41
                                                                                                                                                              SHA-512:E0F57314C136211B8253EB2AC0093DED82198E7170D4F97C40D82FD4EC4123D2AAFE3EB4EBC3E7523C4DF4D77619408773871BDE15B6DC6C4049C71D5B9D4222
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....hExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:11:38.............................A.......................................................&.(.................................2.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................z.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....b.xH......T..I...S.q.~..../s.R.x.....8.a..vE.5...-.G.A.4...._......$K..d.@NC.q....J.....>e".I.%...I0).R.I$........M3.F .

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004L.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.31474456614109
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:DsdVjePH6NtqVMoEMxqX2y9PlorBrdqrR/a6RX8rOm804zPSUt:DsreyN0RElX2y9PlERy06uKSJU
                                                                                                                                                              MD5:7377B94790BBCE653920E287880D9A12
                                                                                                                                                              SHA1:E3E38A535F5E854B5C9D60AE076758FF712CD8E7
                                                                                                                                                              SHA-256:971676DE0903B08A681DAD826CE1C7058B28A20E5BB427D3CAF924E5CA10BB25
                                                                                                                                                              SHA-512:02729FB5E51B3911D1BD07A764C33604F6883FA857F082ED49BF9DB61FEC14113ADB93832FFFCFC5661C2A51DD10366485A35A819167ED4B7A534D742D5BC691
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......L...v...@...................................................................................................................................2...>...(.......v...t............................I.......I.qk..B.....LZ...........S....3..D.......S....3..D.........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............3..SQ...-.....qG....N...^...............>....\.I................f........................................I.qk..B.....LZ............3..SQ...-.....qG........3..SQ...-.....qG........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004M.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:26:15], progressive, precision 8, 216x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):64118
                                                                                                                                                              Entropy (8bit):7.742974333356952
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:ORG4azGOKXzkEmR4bdRSbxONOoz0khbSb4J/5GZK5SWUlRwUYdv1M:ZXzGXzJdhRmgHfIb4J/5GZK5SWUldYdq
                                                                                                                                                              MD5:864EEA0336F8628AE4A1ED46D4406807
                                                                                                                                                              SHA1:CFCD7A751DFDBE52A20C03EE0C60FDFFA7A45B93
                                                                                                                                                              SHA-256:7CE10D1EA660D2F9CF8B704F3FAB2966A4CE2627D9858D32C75D857095012098
                                                                                                                                                              SHA-512:0CAA0C54C14571C279A75F0D5922F78A17803CF6EE1724D66819F7F5944C0F5B25CB586BB686A52808CDF2F8FEB3E4864052A914884054EF7DE44124A8CA951E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:26:15.....................................................................................(.....................&...........s.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................#.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....NC+n....<.=.7..&.8A56..@^.Q..\\...E.>..".&G.......J .'....$.I)........0.../..mv...D....<v0=..ugc+..l.o...=.c.......x.&D..{`8...v

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004N.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.283029539967628
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:5g+Osmi3DL4xF56t0lZtt7KEpsXZoE79HHoJrdqrvCBJzFLW6RXCTp7aLUHuQnqW:5osYnIt0lZPWEqXZoU9HHIRyvGfc7px
                                                                                                                                                              MD5:1C3CE7B70DDE26E6B26D39B0E417D1A2
                                                                                                                                                              SHA1:23FE0CC6C9634A08A153363FA10F4D2B686CD28E
                                                                                                                                                              SHA-256:392818E2C60528613E7B680FFC4CDFD6010FC2853FE9ECDC23E62ECC4065CEFD
                                                                                                                                                              SHA-512:69EEA8187B0F7AA18EADED2042A2F9997AF6A1AA578ACA218D1186D0B602347AAC06E84F31DE4C0467417956FBF562988C50C31B666CB722711286F8B211AA13
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZd.7.....d.7.}...,gd...5nd.7.}...,gd...5nd.7..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............?..T.........hU.....N...^...................*G B..`?...3........f........................................I.qk..B.....LZ............?..T.........hU.........?..T.........hU..........d.7.....d.7.....d.7.........................................d.7j....d.7T.]..d.7.....d.7..B..d.7H....d.7..B..d.7..>.)d.7..J...................;........4...4...4.."..............d.7.d.7.d.7..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........d.7.....d.7....#d.7............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004O.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:09:29], progressive, precision 8, 609x675, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):65998
                                                                                                                                                              Entropy (8bit):7.671031449942883
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:klZtmExaFrtWgpc+Sg+DKeplHClpHfRtPMbe:VEWWl+SNDKqlH8p/vse
                                                                                                                                                              MD5:B4F0A040890EE6F61EF8D9E094893C9C
                                                                                                                                                              SHA1:303BCBA1D777B03BFD99CC01A48E0BB493C93E04
                                                                                                                                                              SHA-256:1F81DDE3B42F23F0666D92EBF14D62893B31B39D72C07AEE070EAE28C2E6980E
                                                                                                                                                              SHA-512:8F07E4D519F2FD001006BB34F7F8274B9AF9EC55367B88D41D24E5824FCE4354FD1290CE4735E43930829702ED53F41DF02C673904A7091E9354C28E029AD4EF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:09:29.............................a.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..-O..s(...gO..@...[..+....+...H.'m........L.......@.......[k...S..O..p.'{X..3......]W..w.+.V....[.-.....2..i..i$.p.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004P.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):3.2520008134404708
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:6sXub5l5W0+WEcgvqjX1E+9//qIqIR0TqYupvZtlWGs/Y:6s+b5l5WpcgMXm+9/pqIR01upd
                                                                                                                                                              MD5:D9F3D9496BCDD0E42B778DE2636F9C49
                                                                                                                                                              SHA1:E2B1EF6AF8C3FEB56818A17D85E45746B1103A31
                                                                                                                                                              SHA-256:A0000B4548CEDB33AF3B349C6648278E2C9026DE2AD5404375EAAF50ACCE977A
                                                                                                                                                              SHA-512:D1CBA4F1E485D82A209305EA11F01F813E10B410E5D76B5A3C470A25AA9D6E0A20D912751758FAB0E96654688C4D56CF228212CDDF43057FAAA17FC86CF7CE65
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>...........v.......................................................................................................................................2...>...j.......v................................I.......I.qk..B.....LZ3.......3......eB.<J..3......eB.<J..3....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.....................8.$s.....N...^.................+c/M.E....2.+........&...................................>....I.qk..B.....LZ....................8.$s.................8.$s..........3.......3.......3...........................................3..j....3..T.a..3.......3....D..3..H....3....N..3....?.#3....9...................;........4...4...4.."..............3...3...3....z...y.. x.. ...........$........4...*..7*..7...........Op.b..F.$..i.................;........4...4...4.........3.......3......#3..............................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004Q.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):32656
                                                                                                                                                              Entropy (8bit):3.9517299510231485
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                                                                                                                                                              MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                                                                                                                                                              SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                                                                                                                                                              SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                                                                                                                                                              SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004R.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12824
                                                                                                                                                              Entropy (8bit):7.974776104184905
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                                                                                                                                                              MD5:2628353534C5AD86CBFE57B6616D46DD
                                                                                                                                                              SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                                                                                                                                                              SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                                                                                                                                                              SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004S.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):32656
                                                                                                                                                              Entropy (8bit):3.9517299510231485
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                                                                                                                                                              MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                                                                                                                                                              SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                                                                                                                                                              SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                                                                                                                                                              SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004T.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12824
                                                                                                                                                              Entropy (8bit):7.974776104184905
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                                                                                                                                                              MD5:2628353534C5AD86CBFE57B6616D46DD
                                                                                                                                                              SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                                                                                                                                                              SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                                                                                                                                                              SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004U.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):32656
                                                                                                                                                              Entropy (8bit):3.9517299510231485
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                                                                                                                                                              MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                                                                                                                                                              SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                                                                                                                                                              SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                                                                                                                                                              SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004V.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12824
                                                                                                                                                              Entropy (8bit):7.974776104184905
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                                                                                                                                                              MD5:2628353534C5AD86CBFE57B6616D46DD
                                                                                                                                                              SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                                                                                                                                                              SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                                                                                                                                                              SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000050.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.348674096854203
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:YuA1sgtxP1wW1Ft8Xr5Eya7nXjocF9bHjdXrBrd3rJxRRX1p/DZR:YH1siH1FKb5Eya7XUcF9bHlBRb9z
                                                                                                                                                              MD5:FC8E7B42CCE748D9E6F32450AABFD065
                                                                                                                                                              SHA1:382D3D2A88E6DC61E4B75FEEAE74649A1626B538
                                                                                                                                                              SHA-256:95BD791AB77799EAD9303178FA4472DC51330F660864802B66D61C5964B1D63E
                                                                                                                                                              SHA-512:E435666996206520F9F32150FEBF42CB5D88DDEC257CC9F892A03A365B69CBF6EA7CD94B5E3A6B09D26AA3B8E94B3E860EE9177B96AD01EE043FF554B0124BDD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ...........Mg.d.,.Y.RHR....Mg.d.,.Y.RHR......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............+..NV. I.Z98......N...^..................)7fE.Y...:m.........f........................................I.qk..B.....LZ..............+..NV. I.Z98............+..NV. I.Z98..........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000051.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):39010
                                                                                                                                                              Entropy (8bit):7.362726513389497
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:6tCjwO+E+KW0ZtOgepcoWW4pAWQ6/KWcR474HOAZaDfK:68j+E+KW0HOgep/72/NKWcRNefK
                                                                                                                                                              MD5:9700DE02720CDB5A45EDE51F1A4647EC
                                                                                                                                                              SHA1:CF72A73E1181719B1CC45C2FE0A6B619081E115E
                                                                                                                                                              SHA-256:7E6A7714A69688D9FFDF16AA942B66064A0C77FCD9B3E469F89730B4B9290C3E
                                                                                                                                                              SHA-512:5438921467D62376472007B9EBF3C35C9D9FE3EDE04D99A990129332D53EBC8EE2555C0319A4F7C0DF63516F29CEDF2171D8B6DC34C9FCD075C2CA41EB728660
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!1..A...Qaq..".......2BR#...b%&6..'w.r.3f7W8.s5EUeF.g....CS$4.Vv..Tdt..G..(c..u.Hhx.......................!1.AQa..2.q....".s...3.4BRr.#......b.$c............?........uf.....t...;..[...W.h.....-.k.f..i.u..KQ..b.F...rM%/.8n.S..=9.....G$O;.f.}L..N..U._i.[.X...3.~....S.~..+t$...c.5......{..X/..#.G...}s....6......^....o~.$.\WA?...^*w[O.~..6..~....a....~..:..0.......{O...|.s.u._w.........i...........{K...._.?.../{.....A..8....<g.iu..<..................X......|]v....D..9.k.w.|-IF.Tv.-.&.........."'.4.b....z.._.Z.....G...u.xyt./_.q..m>..S.V.Xdc.bw.T.W......g..........}s.._..?....U]_.......`......>.|'.~xH....,...?........?.q....o../..R..;...Y.G....A"?......?.<..1...w..o.M.........tco.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000052.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.39805324313226
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:zWz7SsR4U5Wza/PtST/4Er+/UcXgWc9wIj4Vrd3r/Axj/kdX+x82jeyp:87Ss26PoUEEUcXbc9wIYRbG8Jeh
                                                                                                                                                              MD5:48204BAD8C2FAB3675BCF2715194E3B1
                                                                                                                                                              SHA1:9C0B3B93881C2EFEF1C669AC75DFBF5E678AB467
                                                                                                                                                              SHA-256:8759F3C1629C9B8A7D1730A53F9AEF5F1BF3E80703953A326CD684D9C11F0207
                                                                                                                                                              SHA-512:D657438BA430E939680C971EDD04B6655EF79867A47626165C18661BC67F17F4DF19B9976CAE4FA29EB73B78CCDDAE7D2179EC54CD7C79A3094D170A74D76D38
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......h...v...\...................................................................................................................................2...>...D.......v................................I.......I.qk..B.....LZ\)m.....\)m...E.5n......\)m...E.5n......\)m..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............!.(;.......nT.....N...^...............@/..ss.N......z.........f........................................I.qk..B.....LZ.............!.(;.......nT..........!.(;.......nT..........\)m.....\)m.....\)m.........................................\)mj....\)mT.]..\)m.....\)m..B..\)mH....\)m..B..\)m..>.)\)m..J...................;........4...4...4.."..............\)m.\)m.\)m..z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4.........\)m.....\)m....#\)m............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000053.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):25622
                                                                                                                                                              Entropy (8bit):7.058784902089801
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:EhK81gTCyJ/Gf9Aw3t8w8EtdPeGDh6bEi1Ie1u4ZbvgwTwrSRh7ZKNpIGY:IjcRXwdJvtdGsUbEi1IeY8vgwTyC1+Y
                                                                                                                                                              MD5:F8CCFC24DEB1D991EBE085E1B2D7D9BF
                                                                                                                                                              SHA1:AF76C22A765434AEDA134924C517C84107F4FED5
                                                                                                                                                              SHA-256:7354001527AB554C44E7D6981B86DD933B7DC2E0D3DC8512AD3EECD843245C52
                                                                                                                                                              SHA-512:818BC3690B01B30BC571E4CF45EC8D1AFCAECBAB003532644381F1CF730A5B3486862D08F7579B2D3D89167AD7DF35028881245C9550B0DA23D1F81A720A9704
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!...1A.Qaq.........."2Rr.#.t6..B..3S$4..v.b..Cs.%5..8..cUV.(.DEe.&Ff...T.d.......................!.1A..Qaq...s4....2r..S"BR.3....b#C$.....c............?..D.."}:......&&...?3..W.q*.......]...m.Y.k1......K).J...uV.b.../.0.E.H..4..W_T.[t.V.w.9.x.qe.L..o.oL.....d.\.....6.|.o...}..H{Yn..E...6Y3.l.e..D.:,.n.%...t...m.........,+,..|..n.....6.*...f........6.../$../Vi..H...e.f.F.zn.).n.E..2sTn.i...Yb?6+H&...Bf..*....z.o.^7[..u.:o....t.s=.....(.s.....f.g....q9o.u1L.N...smzE..[>...+\O....j.<....j.c.W.............U..+.F/.'..W...T./W...>i01./....j.s."..Q...{...a._~OW...Rp.)*.e..W..Q4)<..'..W...q...'..U..z..g......U}...O....w....0F:.N..V.3W.|..'z0.]...j..U[v..g$D.Lc[.e...UW.m0+

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000054.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.332636697002927
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:YusAwTw6ssFHyVsZJWtGIQwIEHGKAX5+9gg6j4Brd3rUoxQUZdXJDxGUdV:YzE6sgJWcwIEmHX89gLURbcKss
                                                                                                                                                              MD5:C4334CC6BBF44042BCCD8A9BB544834C
                                                                                                                                                              SHA1:2A8CBECAC034C526EB72761E48653BAD8F394A25
                                                                                                                                                              SHA-256:4B8FABEB1947390DDEFD3157B872C23AC7BB496CF9B1E5E9A6F781B096B73AF4
                                                                                                                                                              SHA-512:6EDB259FCF74656C378341F4DA497AEC9617E2B6591201AA445E8C41F7FCCFBDDF0CD248B6CBC30EB697C8717F65B0E423BF74C3B95D070CCBC7E35E0D6BC457
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZy.......y.....;.1Q..*.5.y.....;.1Q..*.5.y....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............U.../I..1{..l.a....N...^....................I.I..|..'o.........f........................................I.qk..B.....LZ............U.../I..1{..l.a........U.../I..1{..l.a.........y.......y.......y...........................................y..j....y..T.]..y.......y....B..y..H....y....B..y....>.)y....J...................;........4...4...4.."..............y...y...y....z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4.........y.......y......#y..............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000055.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 50 x 500, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2033
                                                                                                                                                              Entropy (8bit):6.8741208714657
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:P37XYSDTz+UUl7DHt7Ah8l1+4ZfFclFUXwobKXlZr:v7j3z+UoDN0h8ugf2AwobMN
                                                                                                                                                              MD5:CA7D2BECCBC3741D73453DCF21D846E0
                                                                                                                                                              SHA1:E34B7788498E33FFF0CFB00125E6BA9E090F6CED
                                                                                                                                                              SHA-256:E9EAD0BFC09D32CB366010CDFEDE1C432A2D1D550CB7332BADAC1BEE9482BC86
                                                                                                                                                              SHA-512:7FE2C3654262B1EEBED4F6D83DA7D3450E1BE52500A3964185FC0092041506A237A2728E5D7EEA0A3814E413E822B803B789C49CF744D51816A2E4EDE5B4247B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...2.........H'......PLTE........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................[....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.\.W.G...=a.ewA..a.!r( ...%Dc..x.x....N.OO...3=...S...........~.z.D.0...g.2P.7.*M.#'....z.......3TPj.Z.[5....V..z'L3...a.j9..C>..9.z

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000056.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.343929134039691
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:6sy+qcf8I6rbxhtwYWxEkJLxXSoz9Eej41rd3rAx2ddXe5ZZNdMq:6s7fd6rbxhCxE8lXT9EeARbJod
                                                                                                                                                              MD5:BDF814FD4BB5478A76BDE4EC7461C6EB
                                                                                                                                                              SHA1:B4DC7579EC1224A0561D145407DA31241AA65A9D
                                                                                                                                                              SHA-256:BE4CE9D2EA28E6BFE8EDE3FB8306260644E6AD3423D7AA86471C25F5EEC16147
                                                                                                                                                              SHA-512:2A10C2F6A99A44A48B7618CBD049D76551EDB25E437D2941182BE56DF7131200CE0565653CFB4EC2A3443E15A780214291E9F613F41F71660915E6C71C810FA4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.8)......8).?@..>3(..I.Z.8).?@..>3(..I.Z.8)..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............r...Vp.0\d]..[(....N...^...............J......I.q.f..t........f........................................I.qk..B.....LZ............r...Vp.0\d]..[(........r...Vp.0\d]..[(..........8)......8)......8)..........................................8)j.....8)T.]...8)......8)..B...8)H.....8)..B...8)..>.).8)..J...................;........4...4...4.."...............8)..8)..8)..z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4..........8)......8)....#.8)............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000057.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):55804
                                                                                                                                                              Entropy (8bit):7.433623355028275
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:gVvci05lhVbfBcWvBLeynluexaWqzww/u5:gVUZhHDljaHww/u5
                                                                                                                                                              MD5:4126992F65FE53D3E3E78F6B27FD49DC
                                                                                                                                                              SHA1:BC0D76B69310DA9B909D3EE4CECBFE5F386BFB45
                                                                                                                                                              SHA-256:3FBE3C1C238BD7DBC67F8CFF5F3BDDFD513C96A9851B9616477947D21DFF4B2E
                                                                                                                                                              SHA-512:624853F5E56D224C8188F122B2C4724F867D4099E7FAAFB9C945BE7E2907900ADCF4AE97AB08909CF94E96FB6F381E3B6396D560D93EB2731E4E69CBFE628F10
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d..............................................................................................!1...AQ.aq"2.....BR..8x..r#..9b....3....CS$.'.cs.......7Gw.(.4%5&..Wg.h......tEVfv..H..........................!1A..Qa.q...."2..u6....BRr.#...b..3s..d...7.Cc.$Tt..S4.5Ue..&..%.................?...,...8..{..S.y.N....%..q.8..H[5....o..xg........)c(.eO.YO..._D..x.U.....%.S.r.r._.^..Su.h.Q.t.:.#?....x..B.S...Q.....oqF..%..8'.qx....%.2JKjF..{y.w0.*a.RMb.c.Q{%....eW'..[IV..'ZW3...[...MN.....rO.:....$.i..7....Vrrr...I.r..M..Qo..j....q.^...N...J......%.J..)F...>$.....u........o...+......[...*..t....R}.I..R..S..GB..:......).6_[^Xft...F.1.....zP....,.#....MG.T..Q.F.....)Fi../.I...,%.voEb.b.Z..V3..FT.}..[Z{....wd.z.e.....QwW(.).t..\..'....:)<W.<..&k...caRT.X(..K.....:f...]...q..

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000058.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.471818596443102
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:VWsTyLzKHtrzEWX39MMYRM7GmK54bKo+5:VWsTwKNrgWX39MMYRMSmK54bK95
                                                                                                                                                              MD5:63BEA40184AABCB1C38C6F6446864888
                                                                                                                                                              SHA1:B68AABB03BE0B6A1DDC7101EDF66F2C200E61D05
                                                                                                                                                              SHA-256:3CFE73C1E1FCF83D3E2F0B422C2DAE449862A8F50657D5E77779D699C2832B5D
                                                                                                                                                              SHA-512:0517A6C8D21F084B0DFA683C74CE8C0ED6ACAA18E1428A91F597178EEEFCD1F101495218B32159EE20811AD534D96B2C2BF5DE82F644E084EA9B951C63FE15ED
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......n...v...b...................................................................................................................................2...>...J.......v................................I.......I.qk..B.....LZ.[.......[.J.KB.6.gs4....[.J.KB.6.gs4....[...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............*...s.......l.......N...^.................'...@L...p............f........................................I.qk..B.....LZ............*...s.......l...........*...s.......l.............[.......[.......[...........................................[.j.....[.T.]...[.......[...B...[.H.....[...B...[...>.).[...J...................;........4...4...4.."...............[...[...[...z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4..........[.......[.....#.[.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000059.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:08:07], baseline, precision 8, 595x450, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):59832
                                                                                                                                                              Entropy (8bit):7.308211468398169
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:HS9SYFtN0+CRa9mfJy4zBAiIJhzrkHDV2hJK:yAmta+Tyy4zBIJW5WK
                                                                                                                                                              MD5:DCDD543A4E0BA2C1909BA095D46FFBCB
                                                                                                                                                              SHA1:B86C89537138FE07255354202D3EAD0B53B3C54D
                                                                                                                                                              SHA-256:28F334B77068F71F5F92A95695433B950610204A0E5580CE567DB8FAD4993ECB
                                                                                                                                                              SHA-512:5408C3259B7F3288A4BEB04342799AD5FE3A6F0EC7E92353B29B7E7E538DFA9903B39637226919E0421BC422635D25F5F8069DC7441864DC03E1B909BF5C2C84
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....fExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:08:07.............................S.......................................................&.(.................................0.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................y...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?......;R~+'....xh..~.n-}.......Te................^B..IU_....._...S......h.......!....9...A}6V=J......C..c.....Ug.Wh......

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005A.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.314738817620882
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:DsZil4u2RLJZTtUEQ2MX19E37j4TVrdMr+KdXNov2vXhTh+Yg:Ds5JZTWE6X19ELcRMJ4Y
                                                                                                                                                              MD5:4FAC9FAC9758E464EB7A5D8E348F39A7
                                                                                                                                                              SHA1:66E01851AB78AD392C9AFBCD9BB78A89C1C5A85C
                                                                                                                                                              SHA-256:78F463FD2E7C78D93ACAD72B4E47E5F8E27D1D9BC353C56210FE3F1460B34920
                                                                                                                                                              SHA-512:565DAA9F699578F85B68794B19E2F2920FD38ADA329751418BD63155C9D64DC5A91981A4A0DA62425F05C716587FA049456EA4D2154AFA8E958B5A1371EDB5D8
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ.7.......7.D.(d.-........7.D.(d.-........7...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............>......6..g^.S....N...^.................D.C..J.=.[&.ps........H........................................I.qk..B.....LZ.............>......6..g^.S.........>......6..g^.S..........7.......7.......7...........................................7.j.....7.T.^...7.......7...B...7...C...7...>...7...|...7. .3...................;........4...4...4.."...............7...7...7...z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4..........7.......7.....#.7.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005B.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):33032
                                                                                                                                                              Entropy (8bit):2.941351060644542
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:ofmqvnCfmqsp1Ue5xzMq+Qh0dffUmS0w5xzMq+Qh0di:AGAp1rmSl
                                                                                                                                                              MD5:ACF4A9F470281F475EA45E113E9FB009
                                                                                                                                                              SHA1:B20698DDA5E5AFDD86BB359A6578C9860D5DF71F
                                                                                                                                                              SHA-256:5DC2367A80588A7518DB5014122510BF0FD784711015EF83A8718336584F82D0
                                                                                                                                                              SHA-512:998B7DB9DB08FD15A293267E2371052E436E024AF8D34F96D3C8FF04B1316678DFC1674C921CB404121FF381A4FC39DC759E6698F19D42A6261CBD39469B0A08
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....l...........................Ac...... EMF........$...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC........................F...(.......GDIC............^...........F...........EMF+*@..$..........?...........?.........@..X...L........................."B...B...B...................?...........??.....n............;...<..@<...<...<...<...<...=...=.. =..0=..@=..P=..`=..p=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...>...>...>...>...>...>...>...>.. >..$>..(>..,>..0>..4>..8>..<>..@>..D>..H>..L>..P>..T>..X>..\>..`>..d>..h>..l>..p>..t>..x>..|>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...?...?...?...?...?...?

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005C.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 3005 x 184, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12180
                                                                                                                                                              Entropy (8bit):5.318266117301791
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:k1bHyG/fKOOOOQJUg+g2S+kEm6alfsfsfn32:+bSG/yOOOOQ+g+gOab32
                                                                                                                                                              MD5:5C859FF69B3A271A9AAB08DFA21E8894
                                                                                                                                                              SHA1:3156302A7450ADFF4D1B6EC893E955D3764D4DD4
                                                                                                                                                              SHA-256:B4A8E9A67EE0B897615AC4CCE388FFC175AB92D9E192E6875C79A4E7C1B5BB6E
                                                                                                                                                              SHA-512:4CF518136EEBCA4F400A115D9B7BB0CAC9FA650BF910B99E15F04A259B7D3EFCFFD6796886FE09DB08C37C332B14BC8500845C09C8EAE1F2306F90E98D3C99E0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR..............;j.....sRGB.........pHYs..........+..../9IDATx^...dW...S=.dL$.............-.`...'...x.7.D...(...$.?cO....9S]=.v...Z.......{..wNuf.&.....a.k5~...._..\.yk..v.....}{._.Q...5...._9o.n.....}7.].1v..t......q....3.<..0<.p.......0....s...... @....... @....... @....... @....... @...X.'..U-..... @....... @....... @....... @....... @......,I......+..... @....... @....... @....... @....... @........z...r.. @....... @....... @....... @....... @....... .$.C.KJ[.... @....... @....... @....... @....... @........&`.=X`.%@....... @....... @....... @....... @....... @....../)m.. @....... @....... @....... @....... @....... @ ....`.)....... @....... @....... @....... @....... @....K.0.....J....... @....... @....... @....... @....... @...`.....\.... @....... @....... @....... @....... @......,I......+..... @....... @....... @....... @....... @........z...r.. @....... @....... @....... @....... @....... .$.C.KJ[.... @....... @....... @....... @....... @........&`.=X`.%

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005D.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.35344523174128
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:osjPHoprtrStEPEczowLPTXQ9EsRp5WCrdMryNqxQX5969A1Ix1:oskprUEsAow3XQ9EI5RM7x
                                                                                                                                                              MD5:ECADC70C80DEA34B96582A2E56EBBF29
                                                                                                                                                              SHA1:81A700FE9ED87928F6263D37B4D3265504B4A495
                                                                                                                                                              SHA-256:3A61FF2821DC80C73435F582C013A6BDE3E9A7CC1BD98D56FA8C00E16306560D
                                                                                                                                                              SHA-512:B000D83BB4C7F023C3F299F0F58EB8CD6380B679A230AE35AFF40A69DE4126E12A782A67FB9938707F950F90C662DC7D12706FD9B4371F85FB9536B872CA23A0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ._$......_$3u... ....u..._$3u... ....u..._$..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................FL..2....X....N...^...............n..5...H..#6.{.E........f........................................I.qk..B.....LZ................FL..2....X............FL..2....X.........._$......_$......_$.........................................._$j....._$T.]..._$......_$..B..._$H....._$..B..._$..>.)._$..J...................;........4...4...4.."..............._$.._$.._$..z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4.........._$......_$....#._$............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005E.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 39 x 600, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2104
                                                                                                                                                              Entropy (8bit):7.252780160030615
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:2PPEOtz2P/LJtVRaqBG8qFOPvHlcEXgkuwf+j:2PZFSjJDjqFOPPlXgG+j
                                                                                                                                                              MD5:F6C596F505504044DF1E36BA5DA3F09B
                                                                                                                                                              SHA1:BCF17EC408899B822492B47E307DE638CC792447
                                                                                                                                                              SHA-256:EDBB86F160050FBF1F9860276802BAE292DBFD0BC98E3EA90D43D981E9F0C54A
                                                                                                                                                              SHA-512:E8D067A1932CED8746FE7D665EEC34EA92A98AFF3DF26FFA9DD02742DDEA3C5654124A88A649FA33DB596F96A5FC9CB2C693D03132F1C8B254ACB56DB4763BD8
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...'...X.......:....PLTE.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................{.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^..c.%i.F...m.m.f.m.m.m{&....X...9.....M.WUW.d.N.O...E$...$...)H....n....N.k..v.....v1L[w)w.}..!...Y.X.V.D.......[....;..[..;....

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005F.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.345398175811758
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:R+XDsde4Y6L+Otj3E2JlZMBXFGY9BsTpy9rdMr1DdmkuFX9pzPEHVj4g:EDs1LL9E2iXFj9B+ARMFIkuhQj4
                                                                                                                                                              MD5:194A46ED0C42624833C89252D2DC6317
                                                                                                                                                              SHA1:3B828E5F1D02A19C8DCE6F36746599AC85A202D7
                                                                                                                                                              SHA-256:5B85E6A890BC64B8C752FAC5508115ABB21F2044049367C56AA8C0262C5A3636
                                                                                                                                                              SHA-512:ABA1A7BB7DD30FDAE2FAC52007FBA3B65DF44ED015EC3B31C825B6BC807471794ABB9DA51F0636317C6FF3CBF15981F83791F8B2025837530DD1D47EBAEE8B79
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ6.&.....6.&..S..>..K.Fw6.&..S..>..K.Fw6.&..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............)...v...09.........N...^..................'.SO.I....O........f........................................I.qk..B.....LZ............)...v...09.............)...v...09..............6.&.....6.&.....6.&.........................................6.&j....6.&T.]..6.&.....6.&..B..6.&H....6.&..B..6.&..>.)6.&..J...................;........4...4...4.."..............6.&.6.&.6.&..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........6.&.....6.&....#6.&............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005G.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):14177
                                                                                                                                                              Entropy (8bit):5.705782002886174
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:EbgGcV/hlvpfal7rgYa8S7auAxwfuSTmCSNoFQ6NO7L:EbgGcVnpwimnd38FdQL
                                                                                                                                                              MD5:7CDCE7EEBF795998DA6CAC11D363291C
                                                                                                                                                              SHA1:183B4CC25B50A80D3EC7CCE4BF445BCFBAA6F224
                                                                                                                                                              SHA-256:DE35AF949D4F83E97EE22F817AFE2531CC4B59FF9EE6026DCA7ECEBC5CF2737F
                                                                                                                                                              SHA-512:560FB15A9C12758D11BB40B742A6EAD755F15AD10D6C5DEBA67F7BC8A2AE67C860831914CBCBCDED9E6B2D1D5F26A636B9BCEF178151F70B4D027316F94F27E1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!.1..A....Qa".q..2.....&...B%6.'..R#3.$E.r457bS.DUFV.Wg(.......................1...3.Q..2Rr....s.4.!Aq.S.aC5B$%............?...n.Liq.}.{#....3/gg.1.M +..~3...q..+=..:.g.i1;P)7.....q..n.s"p...wx........v.t.f;..L/..~....y.r[.r.....n.n3..6i..g..}../........3..x.L.i?We..l.......~..<.;..6..o.....N.t.o6.l..~.......<...m.V...Q.7k.u./wq.t..;.I...}..{...>.L..3m..a....yd......6~.f..~Y..}+..<.[w..'-..?.v.7...v.u..4.......1];..u.MO.......s..p..ms.'.O-o...O......m.k.e....)t....i>..E|....,iOyD|.{......g.n...cu....=..........h.\.Q:?g/?.I.3._...t...d.n.0.%y....S.Q....S.&K.w..&wY<....%.g.v.....$y..#,i;.=...t...I6..yO..o.d..w\k...~......)..rK.......].u....N....e.s..kU.u..'}

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005H.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.342351053545077
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:HpOro0saecaRSl7FtgFLEYXL7rT+X0N9Js3pyprdMr9WFX1x89qSPLUSrhTB:HpR0sD47FKEQTyX0N9JWURMMrCj
                                                                                                                                                              MD5:F7190B7366630190A30E83C7049814EA
                                                                                                                                                              SHA1:53D4A0876C6116377B6C8ECBD4ECD8C62817EE50
                                                                                                                                                              SHA-256:36E22AC46EE4BD24B6205DC4B1E37920B39BBB7B75592D08F02E6C324D936989
                                                                                                                                                              SHA-512:878BC80D9301754B9A45F3D9734E3623A3A823C1D5A7FD6277C5BE8EF1AC87761823801030E7F9CCF0A0B6323C3D1D3B07487B720358C2A8C53AF87E0871D044
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ...........zw.....}..t.....zw.....}..t.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............j..>..|./...;..m....N...^...............s..]..{C.#..dm,.........f........................................I.qk..B.....LZ............j..>..|./...;..m........j..>..|./...;..m........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005I.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:44:07], progressive, precision 8, 611x163, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):36740
                                                                                                                                                              Entropy (8bit):7.48266872907324
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:3nwDxjTvoE0Rjwit4rjucDILWg7/Da0JgGQ8e1S8SA/Khos0:SxjTmZw7nucDILj77a0JgGQvScb
                                                                                                                                                              MD5:9C205C8D770516C5AA70D31B2CA00AF3
                                                                                                                                                              SHA1:9A1002F0CF7F92F1BE2BB25BAD61CEBFAC282482
                                                                                                                                                              SHA-256:E111F96490755C7D71E87C88ACAEA38AFE55BB865B1A14A83C5BD239648D5E2C
                                                                                                                                                              SHA-512:A3E105208B32831265428572B0937DD3C17B793D8611B2DA8D4939F1BEC6050999D375E3F6B87D53AD49DFA0EAE737B0141D37597AA42116C310761973D4A134
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:44:07............................c.........................................................(.....................&...........n.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d................................................................................................................................................."...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..o...4.gP.~.c...K{...V.=...].<.........vS.........s....(.t......X......kk7....~-...yF}^c.Z.\.G./.?t...>....:.>......./.ib..).

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005J.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.4563076448938865
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:57scUSA/7G2vlMtJrELLdNXTn9psXpyxTrdMrrjzR2FXS05kr2iog:57sAYq2vu7ELrXT9pq4RMr52I1to
                                                                                                                                                              MD5:41B7643D7AD5A533FFCD4FEB39AF4FF6
                                                                                                                                                              SHA1:3027B2A159BC4857F59FBCD6036E59171D55138F
                                                                                                                                                              SHA-256:946F14833D8A1CDDD77419185D4450569504BD64F56D3E969BC2299ACB240855
                                                                                                                                                              SHA-512:97C5346C567596CD7EDA2EFEE77F5DA44E89E25FB6180FD61F1BD7F9FE48612560CF8BEFAE7BC9D3F6AB0983B67DEDE65981145FFE8D86A9FB00D7AED7649BEC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......l...v...`...................................................................................................................................2...>...H.......v................................I.......I.qk..B.....LZ<......<..R+..s.%..p.<..R+..s.%..p.<...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............~O]`+1..&..........N...^..................%..&L..P._HE\........f........................................I.qk..B.....LZ............~O]`+1..&..............~O]`+1..&...............<......<......<..........................................<.j....<.T.]..<......<..B..<.H....<...B..<...>.)<...J...................;........4...4...4.."..............<..<..<...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........<......<.....#<.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005K.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):53259
                                                                                                                                                              Entropy (8bit):7.651662052139301
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:dCiCBBenRYWDBCipMYGTbYGLHbXxoP/qEF+MU50qyJ30h2W474S/Aq/xc4674bi5:dCiIQXBCiwbDLHD0/sFyVel4Pi4UgE
                                                                                                                                                              MD5:2EE369ABB7936F8C28FF0ABDD224EA05
                                                                                                                                                              SHA1:FE9D304A7B49E31EAE439369ABC548E265149636
                                                                                                                                                              SHA-256:FB12D59B8BE911247BBAFDD416852E8B74B028005A141CB4DBBBA109B4B6ED2C
                                                                                                                                                              SHA-512:5CF396CA472C32AE988600176114106CB1619404DD899A3867A5AB43DC90583B771EF69B14EF50E56A21F038BF51D8463C6ADD2DE9D4CB523F6290E24A4DECB3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..AQa....q........"2..R..Bbr..#S....3$.....C.4v..(X.DtEUV.....cs..Td.5uf'Wgw8Hh........................!1Q.Aa....q.2...."R...r..3.t..U...B#S.4ub..C$d.5Ee&'7c.D%sT..............?.....?...k,lk^...M".Yo5.Qp.&s}b.m.:...W.x}.*.a......N1..d-n.-..^..b..TZ.W..."....F....^......ve5...^...2.:i...........~u2pK.z./&..u..L[I....Y....@y{|>..MN=:....Q[..H....a........|%..4fV....).....^.9b.f...F...p.=.W...aZ.........Z.t.n.....z3..[..lVh..\.N-.._.sK.y.._e.G.jig.a.7^....u...*.p.5.a.].........u/u..D.yl.XA..f.z..~.x.....N.....b=.uv.2.t.'.N.-.H..n.v.a.A[.Z.....T2...._...:....h..l.E..sm..a.3I...RE...fWb.Ek.0.#.)..Y#T...........u{....U....s.].7_H.2.`O6...P......}..4LR....]4.mid...

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005L.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.346753086057036
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:Gs1t0tUaxK7OPjtNkxEXDJmuXGwL9BsupyVrdMrtpvFXUdZVDZ:GsYUCK7OPjcEXjXGwL9BzARMjvED
                                                                                                                                                              MD5:2EFE00BC2508DFD2E80135DD5A9977F7
                                                                                                                                                              SHA1:BB2C8CA44BED58ABEDBAAE5AA344D12201BF0346
                                                                                                                                                              SHA-256:717EA3F27F2789A5A111F1022020E95C9DDFB03EC72AC60E0325460BBD5F2C24
                                                                                                                                                              SHA-512:9FDA902F86B8E9E7072F0BAB2B812CED79E6AD153CEBA4F9E3917A2A1CB0E02CBA7FC692963FAFF477A982707ED84F698FB0F006C3A8D8E1D563BB0A808A1891
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.o.......o.."x...G.T..l..o.."x...G.T..l..o...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............(sp.....Ph..d>....N...^...............mj.E...C.W...........f........................................I.qk..B.....LZ..............(sp.....Ph..d>..........(sp.....Ph..d>..........o.......o.......o...........................................o.j.....o.T.]...o.......o...B...o.H.....o...B...o...>.).o...J...................;........4...4...4.."...............o...o...o...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4..........o.......o.....#.o.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005M.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):60924
                                                                                                                                                              Entropy (8bit):7.758472758205366
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:kU7O7+CFqO6DkxTgPzo2wqggrrX8QvN1I/ZLBttB9+dPFXbc:hVuqJDaTqo2wq1L84N1I/Z1tT9X
                                                                                                                                                              MD5:D58C51D2CF586A5E14A9EC8529C3B0A8
                                                                                                                                                              SHA1:F4811A353797C29B1E3F5A61B125C46E1534D587
                                                                                                                                                              SHA-256:F927C7825851974A2149868146970706523A49165133CEE6027A43E8C9ABDF27
                                                                                                                                                              SHA-512:34B963173AFBDF07432F4B983D29F10376E4771FE666E9D50B1A81DA0B9F6001FD86B4A08B9711386DE153BF6E03C8E932E2D181C8EAF94EFF34D20FCA7570E0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d................................................................................................!1AQ.aq....".....2B...Rbr#.s.4...3$.5u.6v..CSc...DT..f..t..&F........................!1..A.Qaq....."2....B.s....Rbr..#4...35...CSc.$...DTdt..%..............?....O<......X.O.Fg..{.W&u.u.T~.|r;g!.._X..N.p.4.........................................................yK..xd...6..|%....\j..e.=...Y..f..I.|-....e...$R.j.......~.W#....{.....V.k.|F..z^..:.~..f......"x.....L..K..r../.;..[..l...;.U...W...X.........8.....y?..B...m.......j..Q.g3..G.K....GL.o..n7a..Y..[.'.........x........\......~...f...0\Wc.n?k.|.....1.ww;..2..?...r4uF.MXdB6..W..mG2NJ.E........u...2.q...Z..=(l)jU.X...U.\X.......O<......X.O.Fg..{.W&u.u.T~.|r;g!.._X..N.p.4.......................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005N.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.357578830312318
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:IsaC+rDAtin2aBtzexWxEJtLQxX0fx9JzsSpytrdMrzc2FXAg9qD0zyYGGt:IsxpaBYWxEkXw9xv4RMPZ
                                                                                                                                                              MD5:AF47186CE7DE78F74E24B87FB69637DF
                                                                                                                                                              SHA1:845ADD1B8ADCE0693D35924F843675C6CD7561F8
                                                                                                                                                              SHA-256:E89FE31AD39DFBC1FC2BB3116CC7B6E8A797B10E0DF9C660B0AF09215A9433D3
                                                                                                                                                              SHA-512:5C1D083480049B0104F5AB79E346B482A35DD641FD6712C2F9ACB10F817D2593A2ED234AD91C7E14479A1F3BA4CA7A93113F2BDB339F39B5B442BAE63C1064EB
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZg[......g[...u-..*.[f...g[...u-..*.[f...g[...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............:Uv..._...yH........N...^...............lD.J...D.......[........f........................................I.qk..B.....LZ............:Uv..._...yH............:Uv..._...yH.............g[......g[......g[..........................................g[.j....g[.T.]..g[......g[...B..g[.H....g[...B..g[...>.)g[...J...................;........4...4...4.."..............g[..g[..g[...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........g[......g[.....#g[.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005O.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 39 x 579, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):515
                                                                                                                                                              Entropy (8bit):6.740133870626016
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:6v/7su2/c30mqkg9VgFHe7Ll8UmJX/N+1Zmkk8f3lbtI4:4mc38gFHe18lkk8f3lbth
                                                                                                                                                              MD5:E96BE30D892A5412CF262FEE652921CA
                                                                                                                                                              SHA1:8190A0BFE21D04BC6F3A406E91B87CA69C03A2DE
                                                                                                                                                              SHA-256:0E31DA4DFCFF4A36C64C1CE940362D2309769F36369E4C43C317D5F2FA15658E
                                                                                                                                                              SHA-512:D647F51ABBD013226A6ADD0D551D058C633F867F9AF5A9E099B85D6E291D220F7B85958B07381CD4C7C4F72356DBAFE2A86932AE398E28C56CDDF0744E92EE24
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...'...C........b...`PLTE..................................................................................................bKGD....H....cmPPJCmp0712....H.s....9IDATx^..I..@.C..<..?mo.#C((.J}...~..B...b.I.i.\<.e.....(p.I.EO...q.x.......dRz....K..b0.:.<c.o..0.x\:...F....I&..ap....."P@....DO...q)p*..@Y.CL2)=......1.........4....._.G..^`..lDO...q...X....SL..z....K..#.L#..I6..ap.Ls.,....7&..ap.p..lI...,GO...q.....k.n1..4......3=.f.x.$..4.....o....x.$+..0.x\.,&6...............IEND.B`.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005P.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.351918207000257
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:isg62UXrS6OtY4KO4EPA8ohXvFK69psN0pynlrdMrtZq0yWFXAAEJgQg:isU6ORkEPsXvFn9pM04RM7q0yWm+Q
                                                                                                                                                              MD5:01C4EF07D70019E896B4C8F0C22E3114
                                                                                                                                                              SHA1:3C0612D7C1428CF4FDA835FDD97E90501F505BD9
                                                                                                                                                              SHA-256:670A51776169EC172034D8734AB739900D79CD6780E706D959E7E94829CC561A
                                                                                                                                                              SHA-512:0348B57602357A178889B8F60ECEF80B32DA3C4A182EA5889E64270B6DBFF520D8B9872FCA76616A549D2FC0DBD19C7D2AED7EE385ED4B49E5B2DE96805DC344
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ..n.......n..Y........?...n..Y........?...n..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................y..B.S8.......N...^...............)8.#.OD...1a..........f........................................I.qk..B.....LZ.................y..B.S8................y..B.S8..............n.......n.......n...........................................nj......nT.]....n.......n..B....nH......n..B....n..>.)..n..J...................;........4...4...4.."................n...n...n..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4...........n.......n....#..n............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005Q.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 30 x 700, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1547
                                                                                                                                                              Entropy (8bit):6.4194805172468286
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:dZeDNYbS+238CTUFPA6SXG5qSacX9q73eXu0vC3dU+OB2gbwHRuZ:dykp9FzBBacXQ3uNC3n7xuZ
                                                                                                                                                              MD5:0BA36A74DFBF411FAB348404CCEC3348
                                                                                                                                                              SHA1:4C619790E517416E178161028987DF1CD3B871CC
                                                                                                                                                              SHA-256:2E7AAF26BEC32148B96442E8FFF1BD2CEF2D72630969F23B9A2ABEDB6CFEC93B
                                                                                                                                                              SHA-512:90AF53DB7C413E2ADB970AC345F73E4ED8AF626E179C929E6560118F7A9E98DC7C5FF02B2B3F6C98D397E0FE2D85F3427C6928C328872149E176FA8A99E91F54
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...............\....PLTE.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................D......bKGD....H....cmPPJCmp0712....H.s.....IDATx^.WSTA........b.0gPPP0..E.9b@L(.c.N.U>..@......;...}..B.(....$......5..XS...I....).!....D^.uE...\..5........F."o..-...m.n. .^.....q= .

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005R.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.359596832658992
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:Ws+HFH1Htq6SMKyZ5AOE2XD9iHlgRMIfKH1H6HFHCHFaH5:WsKVFtqQf62XD9igRMIfeFOVGFu
                                                                                                                                                              MD5:201AA96F63FA5065FAB92CFE9FE655B4
                                                                                                                                                              SHA1:3D55D909B81CFA1CE01FC61370005DE423538A15
                                                                                                                                                              SHA-256:3CFE1808954C455BA0EFE549D5B9C4704484C01AF86BFF176368868D8F66D1C2
                                                                                                                                                              SHA-512:A55EFAFB76690FF598EF37E1CA3E989DD89C34BF73FFD3C3EF55B934F40D685573C57FCA209A1B0B976EE188DE099E450528DB959E62EC1D68E3151A7F656655
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ...............9.P.v.jT.......9.P.v.jT.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............c.y.H...-../........N...^...............:s...QL.PG....]........f........................................I.qk..B.....LZ............c.y.H...-../............c.y.H...-../............................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005S.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):95763
                                                                                                                                                              Entropy (8bit):7.931689087616878
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:EoES7mhTyzabUaE77xAOmq0zVruQlttNxlipxVWssMU2YhRy2v6pKKYhQzwMc2:zz7mhTyzabUa4b4xuQlttnlGx8x9h02M
                                                                                                                                                              MD5:177DD42CA99CAA2CCBF2974221680334
                                                                                                                                                              SHA1:35FD86B3DD082A6D4930C67BC0E05D3B5817465A
                                                                                                                                                              SHA-256:525A857D0EDA855A64D3619DF58B1C2D013A73E60FA0D49B155ECFCB2C134C7C
                                                                                                                                                              SHA-512:6FB6D9A6C97B1115C3246690A2F339CD612899AC25ACBA00296EAEAA0A1D094E7339D670969764FE23EB7C08FCDD01C6F78FBC0735D504D5E02AD342901719B3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!..1AQa...q......."...2..B#Rb3..r$...6..C4....Ss%5...tu.c..Dd.EU7....................!.1.AQ..aq......"r..2...4Rb#3$B.Ss............?..H..dV....U..-..0]Cp.%O.Z.Y.e.=/.q.....j76.w@s...5.&&&5...n..w..>.1....;.vR..[.......=.......KtY]u3.g18...).r....&.IZ'.....g..4kY..X..b.......y<...r1........e.._...X...w....op.m%Jr31...S.Vo.._....OI\]....F..V-....\...2j..X.....y.p.$4.....&#..]..n.V..x..P...F..C.f....])..~..Z\.....,..#..v..v...2V.k.SuaydO../[.*c._..oTV<Z.s.[...o.x..>....-....v...#....-.X..L.Z./#.XG.-.0......%w..H.@aZ....C.}...N~.;..R......5.D......I.... .R........s.>..ks....(...S...9....2=. :^.. p.+?(....$..Q..I.........=|..`2. v..t......U*.8.u.. ...'...*...2;u....& 3..$.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005T.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.342760262701568
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:isG4HWdEy0JXHnL9aigRMweIfvS/IUQx:isG426y2XHL9ZgRMweIfvS/I9x
                                                                                                                                                              MD5:47E6BF5CEEDEC4F059BE627CF4B9701A
                                                                                                                                                              SHA1:587DC531B933CA847840236BA7530ECB46A4D8EB
                                                                                                                                                              SHA-256:481415FDD67C660D95AB3B0FC3A2F316FA4684A79D7F4D06B8116E59ADCBD624
                                                                                                                                                              SHA-512:CF0C50EA3FB0A6F1F5397DE9119407E3D87FBCFA7F33AEB9AFB7F6ED7A68E68EB6147FD43B680833BBE1A7B6703AFB54116BC3FD939225318DA3A8DBE6F9B706
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ...............*68*.C.........*68*.C.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............i.!..Y....0.........N...^................TFL...D..?T<A.........f........................................I.qk..B.....LZ............i.!..Y....0.............i.!..Y....0.............................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005U.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):67991
                                                                                                                                                              Entropy (8bit):7.870481231782746
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:3PC0XJjsmsKuZRG1pXuZ6z3wARnV9AEnieCc7cllJcHJ:qyMBzkUZ0gq25c7Z
                                                                                                                                                              MD5:1271B1905D18A40D79A5B9DB27EE97EA
                                                                                                                                                              SHA1:9618608FBD7342DE6C71220A36C3F4995BA9C13E
                                                                                                                                                              SHA-256:5B321A4D81BD499B289B1755F6450A42047C494DFBC112DBD56DA4CED2C15C1A
                                                                                                                                                              SHA-512:C32DD26047F6B8AA061085B38AC2B8335868E1BFD8731DB65544309223A955FA4BF45B06AC8D244408658F51A1775B6F19FF0FFC804989DE706DE8EB36F1436F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1..AQa..q..".........2...BR#b.r.3...$.'...)..C%7gw..(.S.W89.......................!1.A.Qa.q".....2...#....B.t......rc.$%67Rb3s&'CUu.v....S.d5.V4T.e.............?...?..Wj.e.e.......w/..E..eOw_.....6......u..C6h.,..;.g.D8Z..-)O..jy..e;.u.g..w..[.L""k'w.......'1'.[......=..P...S.9a.V./O....q=8xk]...........9......F...e9'....9.O.... .&.....p......c.4...mr...?.......L..'.....0....+..|_...POM=7.?.2.a....};.Z..y./....>./.C.<...;.....|.1>...........S.8.o.O...+..n2...k../.X..9...Y...:.....\...Dk......q.K..\.Wuh.!Z?.mu...R.5.A.S.h.0..[..v..+M.....aUi*.k..?#..._...X..R.&]..[..;../]L..f..V......*.e...ut&.#.J.5....c%..o.$..v.<K.6..T.IP.....6X.*.uf..t0^..-.)m$.!.q(.j.f;..WB6.b.B..R.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005V.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.349090324395828
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:1Csm/6oXL+tSf/EvlLbqWXMAywW9BUxpyW+rdMr7k/G/EqFXM8L9a9bWTq9RGYH:1Csq7+0/EdKWXZW9CxERM7E4j8
                                                                                                                                                              MD5:43AD51A9FEDA31BA2C67A11C8D2ED41B
                                                                                                                                                              SHA1:BFDFF7BDD4D4892A6C5B90B268817386A6E3420F
                                                                                                                                                              SHA-256:35554B3CB70D2FAC99D202D53AB74FADE066D400E09A0DC3E5864ED0AE9E04B1
                                                                                                                                                              SHA-512:521064A8C00E547705EA670D8462BDB56C8F4DD8884A3F6700AC57B60A031CBD3F81EF0401551C69C00940CE7031CD4D0C133E6A28691578BDBDC76E2ED4BC0D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ..>.......>.....)..^C..~..>.....)..^C..~..>..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............z.a5...$S..@.......N...^................8Zan.fF...9..........f........................................I.qk..B.....LZ.............z.a5...$S..@............z.a5...$S..@..............>.......>.......>...........................................>j......>T.]....>.......>..B....>H......>..B....>..>.)..>..J...................;........4...4...4.."................>...>...>..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4...........>.......>....#..>............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000060.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:06:24], progressive, precision 8, 38x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):22203
                                                                                                                                                              Entropy (8bit):6.977175130747846
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:5q3R1VBvq3R1Flrk6Q0QPJJrR39joOVMJ25d1NkMhIwobbtAAAqYnLJZMJYZ2AC:xw6Q0WJR3FoOVMJIIlAAAqYnMJdD
                                                                                                                                                              MD5:2D3128554F6286809B2C8E99DE5FD3F6
                                                                                                                                                              SHA1:FC42CB04151D36F448093BDEFE33031A9B8D797D
                                                                                                                                                              SHA-256:14FA2D16310485AA1CE41F6D774A3D637E8CF8B03C4F72990155DF274FDB6BD9
                                                                                                                                                              SHA-512:D8531247A6E89ECABEA9C4A78F596CCE3493334EDF71AE4F7998FDDD0F80705948609C89756AB56FDFAB6D04DEC5F699A693801A772CA2EE2465BDD2CE5D2D5A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....XExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:06:24............................&.........................................................(.....................&...........*.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...H.....Go.Kxn.b..g...........%?_....O......q......7G......%%.V..8zm.].v?...jJ~._..>.......O;........o..rI.A.....n.a.........

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000061.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.458908846002042
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:dsMcEhltxyMtMg5E15LNdXqi9VUOF6pyNrdMruUK2FXZ79zkEG2y9BuIOg:dsixyMqYEDrXb9m46gRMxWM
                                                                                                                                                              MD5:28BA1A1545CC20E73BD0CBF22CFC0E6A
                                                                                                                                                              SHA1:07211C69FCCCED578417858A27B0AE7FAC3D5C71
                                                                                                                                                              SHA-256:EB0175BA0D81954523B7DA89CAE373F26BADBF9177F406F4F4AA137C11F87E53
                                                                                                                                                              SHA-512:34CA42B1CABCFE6F9ED537C426471336B8F802F90754B6055B7214C77959310081CA94851CF658C7F004AEA535543E04FBE955B045215E3EFAA1F50E3DB21548
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......l...v...`...................................................................................................................................2...>...H.......v................................I.......I.qk..B.....LZ............\?..+....l......\?..+....l.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............$....$.&.C...G.....N...^................l..8._A..B.............f........................................I.qk..B.....LZ............$....$.&.C...G.........$....$.&.C...G.........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000062.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):15740
                                                                                                                                                              Entropy (8bit):6.0674556182683945
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:Elv3GG8/OOs+GouFdxMlxjoPyerzkpuOo2vPMc62PaJseZC+BJoS/:EtNiwdxMlZoPhzkpuOo2PMc6rX8+B6+
                                                                                                                                                              MD5:FFA5EC40DC9A0FD10EB9E6355142D6A6
                                                                                                                                                              SHA1:3D3D6A7E086B3C610C08F1F3E3F883604F06F2A4
                                                                                                                                                              SHA-256:D74C3973C8D1F7C77274691AFB1AA934940674341D7EEE563BE75E563281BDFD
                                                                                                                                                              SHA-512:6FAF2A24D06E6008F3579C7CEC90C2887462BDF83FAD7372FBB74B8DE90340B580E9836F309B68A9794597A598F7DCDA661C9A58DA6D8187C69083B7A17C9CD9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!.1.....AQ..aq.g..8...."r....2.FG..#.E..7.Rb..Cc..D.v.B..3s..$d.%5Uu..&6fW'w........................!....1Aa...d..5e.6.q...Q..."2b.c..r3DE..BRs4U.#C.S.T............?...u.&0...cV.T.I...1..=4....Ce_.g.q.=F.M:>)...k..pm..h..=........S....)Ja8x...b.).=5.q..0......k.M.....1?-.G.b&.5..Ep.8t...'...R)..ta.F$bXO]tW.b.6#.t.XWN..ZW......].....G....x&&f..'L.....7...\...'.8...~`.sa...............................................X........qo...SMk...'.V...i..hb.}&?/.k.:>l.^....>Y...<}...&.jY.Gn.MKejyV......D......gf.0....t.nw..XQ...H.B.....=8.UkR.....Hm..w..]...k...#Z...F../.gjWvf.....w.aZ].2..5..^...VZv..._.7..a.|...:.B...,f...............~....m.;_.....-.e.y.w.[m.].bu.b.f+.E++\.....Y..7

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000063.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.3400208087316114
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:RZasYkZeGjwXtWsS/EAkLoEjgjWXLgjW9DNUCpy5rdMrEkurFXOZ3pdl:nasljwXyEjdPX79DOCERMEkc0d
                                                                                                                                                              MD5:2F7FE559259F4780097E31A2FC6FDEF4
                                                                                                                                                              SHA1:1E87DB33BA79CD237CE9436208A3082C3EAC726B
                                                                                                                                                              SHA-256:7F8D6899890DE7363A560DB331871ED2723CF386F55E4671811A15516B1FAF4F
                                                                                                                                                              SHA-512:B4AAEF4D74AED47C9A27101DE81AE079685A2B4B29037799A6B9D8509444C470C79BA1FD56CCED60C4D09721904D5E82C5434DC433E0A6AC2EBA9DAFF2514457
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZK;......K;.kl....j..'..K;.kl....j..'..K;...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............N..Zk._.8d...m......N...^...............kq.A.nFN..T..4..........f........................................I.qk..B.....LZ............N..Zk._.8d...m..........N..Zk._.8d...m...........K;......K;......K;..........................................K;.j....K;.T.]..K;......K;..B..K;.H....K;...B..K;...>.)K;...J...................;........4...4...4.."..............K;..K;..K;...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........K;......K;.....#K;.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000064.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):86187
                                                                                                                                                              Entropy (8bit):7.951356272886186
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:AbmHwD7za0syWMetp3TdPFzoJamVdAQZCiUit9qbYN6LerhWMzIWgN1EeaYhJM:1QnzsyTeP3TPAdAQZCi5qbYEKrhWWMNO
                                                                                                                                                              MD5:FEE4785DF76E93A9DC2F4501CBAEAE12
                                                                                                                                                              SHA1:8FB4527BDE05EF208FCDB168098A07707C27501F
                                                                                                                                                              SHA-256:F091DED5E283AF6848670A3172E7C43C6099875D39B3FC69C2BDBA914F609602
                                                                                                                                                              SHA-512:7E99D33151A0D3873D6A819C98EA8E62D928C087B7BA2080F11C7BCF746AD60A44D4FF6EE3D2D2E8DFA4BF1FC6285ED56BB83F91C2FC6FC4FDFF2000105F10B1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................1.!Aq...Qa."...2..BR#...br......6v.7..3.CSc...$4.s..&dt%u.f.......................!1.AQ..aq........"2.B#....Rb3..t.5u.67.8.r..$....C4.cs.Sd%.DEUe&.............?............w.....c.....i.A.....3...7.......7..P......%.........?Th..l./?.;.....$}..=5Oa...F.c.A/...D.D..]..y..3e.5\%.fo2.X.*]q.5Ee.}..i..md.T....#...-...Mu...9...-+..~w5O.);..G..'.;..).....A_...M.vV..y.q......,<.3.(...._K:..XM.......w.......9..T.......?b..a-%.c;.}..>....|.,lZKCEB.t...fw|.Sw^..Y..:.J.................t._P..v..j.1.R8.R....G..W*H<(Xi........i..xcu...WM.dqM>'W..g....M.q.....+.....b'..~....>..T.~Jc....fj.X.x..9...N.w.6:..>.......&.(h..u...t._...)_k#7Za...cZ....P...Y..;.V.,..xo.....f........Y...\6...M'L._

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000065.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.6664389492795415
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:eGKstOUIstgrLEdzbULIBhrZXw9EyUqpyFrdMrSvFX2h8rEq/xj:ssRIsKvEtUOJZXw9SqYRMQgh6h
                                                                                                                                                              MD5:D0838A22EA1D427948951A6DAD04040F
                                                                                                                                                              SHA1:3F8883F836D858DD519A2803CD8C2090DFE1753A
                                                                                                                                                              SHA-256:9180A0BC8DB3F8B6EBE922FCA6D0F30DCD56B9156F6A10030BECAE687EE30059
                                                                                                                                                              SHA-512:E833FE522CFC79A55B64AD7DD352DCCE1F740BDD0DE6BC2819ED9B29CCCD048E54ED9C31B9C651ECD84AD5CD6CF4082E88B83DA3245BFA38B85E951C09AF278B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>...........v.......................................................................................................................................2...>...t.......v................................I.......I.qk..B.....LZ.$0......$0.Z.......#..$0.Z.......#..$0..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............,Mrg!H....V".......N...^...............5.p...D..r....|........f...................................H....I.qk..B.....LZ.............,Mrg!H....V"............,Mrg!H....V".............$0......$0......$0..........................................$0j.....$0T.]...$0......$0..B...$0H.....$0..B...$0..>.).$0..J...................;........4...4...4.."...............$0..$0..$0..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4..........$0......$0....#.$0............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000066.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 85 x 470, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):11197
                                                                                                                                                              Entropy (8bit):7.975073010774664
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:p9wNdtRKcVHso6zsqm06xaqZdingVzLZ7/PGSIz/yycRTbChh/JzhbEx15RGb:mdtMcVHqgAqTinMzLZ7/uSIz/yTR/mhF
                                                                                                                                                              MD5:DDC3CC30794277500EFE4BC6667EC123
                                                                                                                                                              SHA1:EFC9642C1F95B5FC38764476AE481649C016FA0C
                                                                                                                                                              SHA-256:7F5B660A1A0BF46C75AAF19B4F77A0E086DE003EC03AFC1F58D871D55AA5BA9E
                                                                                                                                                              SHA-512:25232A84604C3959634D33090238FEC8D51E40AD84EB3A08BB8522A81BE1E83378649C014E98E1DFCDF46B7BFAC92D8D2429211CD11D7EE0334C9C3DF7C1B6A6
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...U.........1x5.....PLTE....................................e........................................................s...............x..........................o..............................................................................................................................................................~.............................m...............................................j...............................................p.......z......................................................x..............|........................................v.......................y..........................................................h...........................................................................P..{....bKGD....H....cmPPJCmp0712....H.s...(SIDATx^.}i@S..N....h...!..)....AI%..p.L."a..)..`U..,h..:O.b.:.j+.Z).b..zN.s..{O...&|..N}...${....~.....k}.[k}{.o^.D_..W:35ly..7rL....6n0.A...b

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000067.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.301571098980443
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:qsu3Ecny28vm1ElTXj9m6URMLseEEf/DGin:qsMy287lTXj9JURMLsl
                                                                                                                                                              MD5:9F29254FBCE2A1FC2CE7473ABDC6D56E
                                                                                                                                                              SHA1:6F0C68BAD1E14D2F05A5ECAB0FF06766364CCBE9
                                                                                                                                                              SHA-256:966F9CA0423EC79F984F4AE342E6D0D2A0D3B3B8231465B6D9EE49F2E6AA7806
                                                                                                                                                              SHA-512:176A270845053E6902EF694424EB66578E5DE501F25F3E49A2A1568B84C912C63713373C3962EAC3077B286F5F96DF1F022B8BD12A704C9EE59DEFC77D09AC41
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ..1.......1.\...*D...K>..1.\...*D...K>..1..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............X...a....l...a.....N...^................^..!.H...2...........f........................................I.qk..B.....LZ............X...a....l...a.........X...a....l...a............1.......1.......1...........................................1j......1T.]....1.......1..B....1H......1..B....1..>.)..1..J...................;........4...4...4.."................1...1...1..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4...........1.......1....#..1............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000068.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 88 x 574, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):19920
                                                                                                                                                              Entropy (8bit):7.987696084459766
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:DRSgtAxJx7bzvAsVSqQElOT4uHmpmvNYT9aPU+QtsC2LgfIqJZnbeyRB:DsgaN7bzvAsVdK4uGQFUZ6bU/p3
                                                                                                                                                              MD5:1BDAD9B3B6DE549162F9567697389E1C
                                                                                                                                                              SHA1:5D9C09159F07A3A9BDCC6C4B9BD9CB72D0184E6F
                                                                                                                                                              SHA-256:0908A4CFA23F93011176D47F45843E9CA2973030421996E8E27484781F54B0EC
                                                                                                                                                              SHA-512:475040779AC247BB5C3E11862FB55FBDDFA12D759EE86A33E11BC1F3B656D6CD0F9B25146C0113E43E1D8001D8867D3BC3BF7E6FE21F3A0016CB1F8B70B7A15A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...X...>......y=h....PLTE..................................t........iw..............................................._n|...Tds...ky......................................................p~.....................................................dr.................v.............................................n{.......ap}..........x.....z...................u......................|..Vfu............r.....w........................................~...................Zjx...................................Yiw............w..|....................Xgv{.....y...........................jx..............\lz.........}..z.....t..[ky........u..y.....gu................................{..........}.....u....................~...........y....r.....bKGD....H....cmPPJCmp0712....H.s...JfIDATx^...\.W./.}....Sy...(..4....D.-.....H...% .$"D.Qr.......`..;...6...N......s...^...L.....Y{.GQU`..~...j....{...-Ax.K..&.....F..I\i..

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000069.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):2.919057202551492
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:5s1lIlzOOM426DstAoSzvgE1Lx9NVSL6MhwGcXeSc9ndsppy9rdMrHgmHhFXtDhc:5s/appIqX4E17N0fwXg9dgARMHRW
                                                                                                                                                              MD5:5820390F951A84E6CD56E61B309285A0
                                                                                                                                                              SHA1:6F562D5259562C65CD86AD3950B76A97759E5757
                                                                                                                                                              SHA-256:47D90D1BAB2019399DF658EBBBD5964113A99D8AC77578E335A0DCFD4D7A65F5
                                                                                                                                                              SHA-512:2356CE54AD14B7C416F1F8513E7ABDEB41BEE44085C64A9B647AA54AFEFD40429A4B4B2D41EFD85163CC61D453A66134E979179334F1358B7E6C8944D910E6AC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>...........v.......................................................................................................................................2...>.......H...v................................I.......I.qk..B.....LZp.......p.....j..k.....p.....j..k.....p....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............!.!X....$..3.......N...^...............O(..`..A.:.....6........f........................................I.qk..B.....LZ............!.!X....$..3...........!.!X....$..3............p.......p.......p...........................................p..j....p..T.]..p.......p...B..p..H....p....B..p....>.)p....J...................;........4...4...4.."..............p...p...p....z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........p.......p......#p..............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006A.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):179460
                                                                                                                                                              Entropy (8bit):7.979020171518325
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:oiKXvL7lv0am/R1vrdH+9dK6zPQ6bbnGDpcGGDNMIOIMAT8q9Vc02Q57S4A+vMFz:+vlvC/HvgA6fGqGGJlO1qZ71W6CzDn
                                                                                                                                                              MD5:4E131DBFEC5C2462273CA7B35675B9D9
                                                                                                                                                              SHA1:CA037F444D819A118AC37D7AA3782B9BF94C1616
                                                                                                                                                              SHA-256:2A4A3530D652E227DDD5ADC096A95F6034718F7C380B07DB622022D768815059
                                                                                                                                                              SHA-512:C333ECEB1439D0238BF44FB7896E62DBA4C645B70413AA0F99C1F10E8DCD20C2EEE5C83F2E9DDE9A2494C85A6D8D13CFFFC4160E2F598E17867015F5244D656A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!.1AQ.aq...".....2Rr..Bb..#34.....CSs.$5c.t....%.Dd.6.T..u.U....E.7w........................!.1A.Qaq......2."r.3....BRb.#4......CsSc...$.5..%.DT.t67d..Uu...'............?..c.......p..z..i.....z......kj........F>f......3N...M....RM.&..-.~.Q..'.....q.a..w...-~......g.{..&.......V.n.D....>FS!n.....@..)...W..q..Wr{..J.gf.{.M$.P@m.,..9..&m.D...w.._...-.O........s.....h.k~......(.K...V..l.-...+.9.k......*......#.p#.O..9M..mF...C.......7+.AI....4vw.;..H......e..Q.u[.eUK.....z.....[.Kt...s..Lf.4..l{.....sh.............=..;..iqkj.m.a...NH......v..H..$..q.y......c...U[Mcf.......+...S-...^....4..T..YtL.x.v.;.....<...Ik|B.$.s8......3.+.8.l.. h.:....%B..W..I.QRS..,*x.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006B.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.354865552585995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:CsNieKNiTYtAYFd+3E4+ZIXAwFKFI9Js+py7ZrdMrWe0wrKkjFXUIXQ/gQg:Cs4ZN2Y1F6EcXNFl9JLiZRMWcrFj5FQ
                                                                                                                                                              MD5:DA39C45F0CBA94F9D41991786675387D
                                                                                                                                                              SHA1:E3768F3279D9807D3EF446098808B332CDDF7797
                                                                                                                                                              SHA-256:F4F3D25D9BA0248E02A10DD3BF44624ADD2AB18D71D8AA117D45FE60625268A3
                                                                                                                                                              SHA-512:BF0727B7AD2E7F69AD186040FAB212FC0E8897CDF33559DA218893ED7AF90107C7A5D0A3B3BF6C0467FAF7457293D7EB0A7B5D9B302F93718AB05EC7A429C0AE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ@.W.....@.W.y...*.....|.@.W.y...*.....|.@.W..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............c}?#.;F.:.weW....N...^...............).....O......Y........f........................................I.qk..B.....LZ..............c}?#.;F.:.weW..........c}?#.;F.:.weW.........@.W.....@.W.....@.W.........................................@.Wj....@.WT.]..@.W.....@.W..B..@.WH....@.W..B..@.W..>.)@.W..J...................;........4...4...4.."..............@.W.@.W.@.W..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........@.W.....@.W....#@.W............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006C.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):109698
                                                                                                                                                              Entropy (8bit):7.954100577911302
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:rDlmvIWr0aRtNCfShCWBxyCHMlcVG0Ezy4FR:rDliIfot8ahCWBcCHDVwR
                                                                                                                                                              MD5:8D804A60E86627383BED6280ED62F1CF
                                                                                                                                                              SHA1:E23FF14B10AD0762DD67FBA3CD6EFC85647C0384
                                                                                                                                                              SHA-256:494547E566FB7A63DD429EB0699FE41AA8998F8EA2F758D813FE3D56C3075719
                                                                                                                                                              SHA-512:0FB19F3D00159F2748C3A54E952E551B9FEA6910D67A54DECA8D099992E50383EADB92768FF1F75CFFAE82A7A157B1E0F77A2F0BE7EC64FD2324304FDCA46577
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...............................................................................................!"#.123..AQB$..aq.RCS...b..c4%..rs..D&....5E6'..TdUte...u.....FV...7.......................!"..1A2B..QaqR.#.br3.........C%...$5.....c4U..Eeu&SsD.6T..................?.....O.C.....^..R<A.g...[....3.....r.0.....nX.S....}...[.?Z.....A.?..~~I..rY|N.o...9......!...o7r../-.y...'5.3.U.s".-.0.1......SS...&.Q.j.*.$m.e..:x....`}...EP.?.7..~G(so.......O.....z.N..<....~^a.e...........p9.?<._..|......~.<@.D.9..G..?.?z.y?z.C.U.w..[.,..A.+........s......g...G.^....pz.xY.....d8.y.X...P..O(A.O..~:._.......<...o..4s..^.^b..x......_a.....|{c...:..X.....}.._...[?..NK.c...}.<......H.G....+x.Z..|....n...o....`.nk.#.%x......-|...|7......N!=././..w.8x.".8....'x........w...,>....j[w8a..}..lS..?.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006D.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.320625950701689
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:CsyzDnSGrtO24E3y1ZXAAv9UesM7pyflrdMrpNFXgRep/qJ:CsWSeIEgXAi9Ue3YRM7T/q
                                                                                                                                                              MD5:315B4A77F76EA8AEDE6FC3788646F226
                                                                                                                                                              SHA1:24005D1A5303DE2A4C74BD4B274CDC8184770369
                                                                                                                                                              SHA-256:88E51B86F8F8C414404C52464894D1C07424726BAE7AD97EBE645FA27EECB863
                                                                                                                                                              SHA-512:EB68405E3C6BAB2FACC97023D0FD3FC90777C3B3E741FDE7B0EE55D10684D6D9B1840316435D6168C5EBF8D4D26D082FF4AB6B7F12BD954CF3C28CB3DF82E7D1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v...........................?.......?.......&.u......I.......I.qk..B.....LZ?.......&.u.....?....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................../...1.......N...^.................'...kE.R.T.e7.........f........................................I.qk..B.....LZ.................../...1................../...1............?.......?.......?...........................................?..j....?..T.]..?.......?....B..?..H....?....B..?....>.)?....J...................;........4...4...4.."..............?...?...?....z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........?.......?......#?..............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006E.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41893
                                                                                                                                                              Entropy (8bit):7.52654558351485
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:pZvVQkUbOHxx3pvVmO5rsP5gUdXwFMuv53knzyncaXgRDqPU:pZkijV5wScXwFMYknzucaXgRyU
                                                                                                                                                              MD5:F25427EFECFEE786D5A9F630726DD140
                                                                                                                                                              SHA1:BC612A86FF985AB569ED1A1EA5FFC4FDB18FC605
                                                                                                                                                              SHA-256:5A36960DF32817E8426BD40A88F88B04FB55B84BAEF60F1E71E0872217FDB134
                                                                                                                                                              SHA-512:B102F34385196D630F198667E874F25ADBC737426FDAE0747EC799B33632E5DC92999C7C715DC84D904342738930267AB1709870BDAA842243E4C283FE5E1554
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................!.1AQ....aq......"......2...Xx..9BRr#.b3$..&..g.8....%F'G.(H.Ss..D5E..v..W..Cc.deu..7w.h.).....................!.1....A..Qaq...Ttu.6..."R..5...2B..S....bcs.Dd%&r3C...#$...Ue.............?..R...%.R...t.MQ*.l...v...V]..n...Zw....M....4..F.&&bb0.:]l......ay.r<..3.l.Q^.........I54.N2.8..2s...w..r6.......[1Zh....O...9..>...B......x]...r.\.\..v..~....y.QT.3.......=....r..}.l.....o;....M..C1....w)...+o1f.]...MoA.E..s5..i.\....miGsy..m\.Zj....I'YU.\tU6La5v.>.K..m.]1.......k..0....</5v.V7lY.e.vV.+./[....f..u{....s.}.Rb.Z.....Y.6]..m....V.\...Mr.=r...K...l..%..m^.......X.(..fG..[F*ly.jL.a4..vs..o.e..q.9km..w1.yg.....r_.*h.n..5i.-.{Y.l...<...'Or.s..Z....../JP.....\FV.S..............m

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006F.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):3.310894096322658
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:iMDTdsdOZU6U4MJWzkYKtrZCrBJmQEtaDsNyEZVbsPJmQEtaDssDEZxlYJmQEta/:iLd2U6HiWzkY8jGEDbPUErl7bW/FMc
                                                                                                                                                              MD5:8C3BE8826663D07FA839D75E1F84762A
                                                                                                                                                              SHA1:8A6B792522DDAD2C4999E69687124DE97BE61196
                                                                                                                                                              SHA-256:D4AC576300E757D7F382F4C827021A682456BF6645B5BAF98306FAB5F68CB81E
                                                                                                                                                              SHA-512:82D022B4D40ECD066E53622BD5E57ADF8E1CA46714274A1D4DF8573942343CDB046DDD44AB202D72E8EBDA7E74FC36A4CA44ABA2A21C074B4F4F0BB585560453
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........$...........t......................................?....................................................................................................\........................................K3......K3..=\.9M+.|.v.z.6.....z.6tO...?g8...z.6tO...?g8...z.6.....'.........F....K..VO.(C.s..5..UK..........................................................................qT&h.....T(T..K..T.<.......{.....X.........7...............$................4..(.....x.(.......q.......q..CNO.@.g8.=.............'..........2...v...........................z.6...q.K............................K.......z.6..c..,0...e...B4.$........[.-...I.......9.....................................K.Y...CPK.......K..VO.(C.s..5..U.K3..=\.9M+.|.v..K3.....u...Ta..<.G....K..VO.(C.s..5..UK.......>.......@...........'.........FK..VO.(C.s..5..U............................'.........F............u...Ta..<.G.......q..........c..,0...e...B4.$..............E........................................0...........e....4....

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006G.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12288
                                                                                                                                                              Entropy (8bit):3.856787794897635
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:ZsuOJH/vdCwLGXsAT7uNRzJ7DVrbV5aZHx9JE0hcf:+9jU9+RzxwNn
                                                                                                                                                              MD5:751978209AB7523204B86060F21516EF
                                                                                                                                                              SHA1:0B22266A792DF2714634E47AEDA048369EA754C7
                                                                                                                                                              SHA-256:E874CC7F11AD6994396D2EDA6F5359CFA06FF18250694117B6AE90DC27858A14
                                                                                                                                                              SHA-512:C2DB60D604BE7F45136E233A5C7A2B3ABAEE6C3B416C669DC672056CC2AC24DF3D7A3F58EC3F619B44CF207812C050937BF678E0795D63B9B0AA457A2E1622A9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>...........v.......X .. "..2...>...d...<...v.......@....!..............................................................................................................................................;......!.."....o...I.......I.qk..B.....LZ...!.."....o.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............D.6......Q...f.....N...^...............,ro@...C.T2.L.* ........h...L...............................D....I.qk..B.....LZ............D.6......Q...f.................................................................................................j.......T&n.....................H.........K.............$...........-...J.....z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.5............(...#...8.....z...,4. .......$>........4...4.@..7.....................D..n4..o4..p4...4. .F

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006H.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:05:55], progressive, precision 8, 612x618, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):68633
                                                                                                                                                              Entropy (8bit):7.709776384921022
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:tapXpSTJDOkFGdJdBk/slsbfsw1imaapnbvD8:U2OjJr6b07m1bvD8
                                                                                                                                                              MD5:41241EE59AB7BC9EB34784E3BCE31CB4
                                                                                                                                                              SHA1:98680761A51E9199CF3C89F68B5309FBEC7EE3CB
                                                                                                                                                              SHA-256:035B26DF61855A3F36DBD30FDAB0C157C04C9E8AE2197EA4D4AEB3E82E6A4C2B
                                                                                                                                                              SHA-512:3EE331D5BCEE4AD5D3FC9661D4AB4053F7D351591A094334F963C33C9D0E32CCCABE9334AD7C308108CE99617E064FE848DCD469ACD8D83FBE5C4452DE523D8F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:05:55.............................d...........j...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?../$.W:SZ./...9.....-...u......r.....].c...@W_.7...+......v.+PD.I..-<1.pDn-\.....p.$....0.}V....\..>.~..XN.o..l(E....ik..o.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006I.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):20480
                                                                                                                                                              Entropy (8bit):4.091690918733447
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:1bvLIyTVGGJgnM276zSlyvpp/SrFSXOpqew9g72B7QpXK/OJ807/RJeXV/Xg8imv:xvL0+p/kJ8g2B7QprRJCqmLz7O
                                                                                                                                                              MD5:3EF77893A9C5E6DEAA2D05A668B91484
                                                                                                                                                              SHA1:8887F6ED40BA4077A939EBEA4A088F590CCB2CE2
                                                                                                                                                              SHA-256:188CAA159E70268AD077212719E23B27DF90E967F3767881209B0BB142437880
                                                                                                                                                              SHA-512:5D36892A268E0B733C24050950F33DE25498CAF36999AB7CFE2A0D73881C7B5BF71A5706BC6F2CF27FC25EA050124C2BB5F4FA9B47C8A82D11AA15EFD7AEEF79
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:N...>.......L...d... .... ...9..N...>...........d...h...@...@;...........................................................................................................................................I.......I.qk..B.....LZ.........../..c...."p$..Y.h4............Y.h..../..c...."p$.U.....I.qk..B.....LZ.I...........Y.h.....Y.h.....Y.h.........................................Y.hj....Y.hT.7..Y.h..~..Y.h.....Y.hH....Y.h.....Y.h....&Y.h........'Y.h2Y.h..z...,4. ...."......$>........4..`..7......L.o.w. .P.r.i.o.r.i.t.y......................Y.h:Y.h.Y.h..z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.2.3................z... ..$........................................2..7.........1.h...?.......?...?....rA\.-?>...o.u.t.l.i.n.e.L.o.c.I.D...o.u.t.l.i.n.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.4........?ff.A......'Y.h%Y.h.Y.h..z...,4. .......$>........4.@.4..`..7.....................D..n4..o4..p4...4. ..1.......Y.h*....Y.h....%Y.h#...'Y.h&...9Y.h....

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006J.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:08:07], baseline, precision 8, 595x450, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):59832
                                                                                                                                                              Entropy (8bit):7.308211468398169
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:HS9SYFtN0+CRa9mfJy4zBAiIJhzrkHDV2hJK:yAmta+Tyy4zBIJW5WK
                                                                                                                                                              MD5:DCDD543A4E0BA2C1909BA095D46FFBCB
                                                                                                                                                              SHA1:B86C89537138FE07255354202D3EAD0B53B3C54D
                                                                                                                                                              SHA-256:28F334B77068F71F5F92A95695433B950610204A0E5580CE567DB8FAD4993ECB
                                                                                                                                                              SHA-512:5408C3259B7F3288A4BEB04342799AD5FE3A6F0EC7E92353B29B7E7E538DFA9903B39637226919E0421BC422635D25F5F8069DC7441864DC03E1B909BF5C2C84
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....fExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:08:07.............................S.......................................................&.(.................................0.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................y...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?......;R~+'....xh..~.n-}.......Te................^B..IU_....._...S......h.......!....9...A}6V=J......C..c.....Ug.Wh......

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006K.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):20480
                                                                                                                                                              Entropy (8bit):3.2468813876560763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:f3FEoyeUJRt/PkgGekdQ/7RJaSKJoig8g:f3FEoyeUJf/PkgGeoG7RUSKmig8
                                                                                                                                                              MD5:5E3DF6DFDDD49F519FF4520A09D2A20A
                                                                                                                                                              SHA1:17D0B2AB463D85F7EBF35455D5E460406286C4C8
                                                                                                                                                              SHA-256:D8452DCCF0D416DB184A7BF34DC130DDE096D317BDC015C1A21F0D635548EF9A
                                                                                                                                                              SHA-512:8E4AD22FBC68D832E3DB12ADB84F0D3DD87891E81BBE30D5BDD3541833EF42727560F76B35698CD9E83AF78B20A64B682671C76ADC527757D618D01B37FCF1AB
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>...........v........ ...-..2...>...B.......v.......@....,..........................................................................................................................................#...P...#.....[.0c.I.!...I.......I.qk..B.....LZ#.....[.0c.I.!..#....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................eY..v.|........N...^................u"...@...Jq.r..............................u"...@...Jq.r..........u"...@...Jq.r.............eY..v.|.....................................#.......#.......#...........................................#..j.^..#..T'...#.......#.......#....-..#.......#.......#.. .L......#..3#..I#....z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.6.............#..3#..9#....z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006L.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):53259
                                                                                                                                                              Entropy (8bit):7.651662052139301
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:dCiCBBenRYWDBCipMYGTbYGLHbXxoP/qEF+MU50qyJ30h2W474S/Aq/xc4674bi5:dCiIQXBCiwbDLHD0/sFyVel4Pi4UgE
                                                                                                                                                              MD5:2EE369ABB7936F8C28FF0ABDD224EA05
                                                                                                                                                              SHA1:FE9D304A7B49E31EAE439369ABC548E265149636
                                                                                                                                                              SHA-256:FB12D59B8BE911247BBAFDD416852E8B74B028005A141CB4DBBBA109B4B6ED2C
                                                                                                                                                              SHA-512:5CF396CA472C32AE988600176114106CB1619404DD899A3867A5AB43DC90583B771EF69B14EF50E56A21F038BF51D8463C6ADD2DE9D4CB523F6290E24A4DECB3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..AQa....q........"2..R..Bbr..#S....3$.....C.4v..(X.DtEUV.....cs..Td.5uf'Wgw8Hh........................!1Q.Aa....q.2...."R...r..3.t..U...B#S.4ub..C$d.5Ee&'7c.D%sT..............?.....?...k,lk^...M".Yo5.Qp.&s}b.m.:...W.x}.*.a......N1..d-n.-..^..b..TZ.W..."....F....^......ve5...^...2.:i...........~u2pK.z./&..u..L[I....Y....@y{|>..MN=:....Q[..H....a........|%..4fV....).....^.9b.f...F...p.=.W...aZ.........Z.t.n.....z3..[..lVh..\.N-.._.sK.y.._e.G.jig.a.7^....u...*.p.5.a.].........u/u..D.yl.XA..f.z..~.x.....N.....b=.uv.2.t.'.N.-.H..n.v.a.A[.Z.....T2...._...:....h..l.E..sm..a.3I...RE...fWb.Ek.0.#.)..Y#T...........u{....U....s.].7_H.2.`O6...P......}..4LR....]4.mid...

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006M.bin (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):2.4769669674063746
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:Nw/aQUW0L2MMR1edCDJt1Ulzvr8POVCUl6jmgOYYjLSIUluLDibdUlipbScrLKgv:Nw3C/MR4dCelz/dlbLGlWuGlyhUl9aq
                                                                                                                                                              MD5:AAB8A663E2B337ADDF17C189518A3944
                                                                                                                                                              SHA1:F954A55D1B1FFBC3259F8569065B98B91085036C
                                                                                                                                                              SHA-256:821A94E5E871E007FF3AF57D2990BD22FCB10716DB07AF7934727DB6DE90D172
                                                                                                                                                              SHA-512:50B9BAE064A9A950C70711B5A5FDFC225409BDC9EAA507CFDE98AD86E98CB1F34F4D8D499DB8469DA1A2392E8EB05448495ECCF738F9BA00EC8B3F5783FDF99E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:...."...................................................................................................................................................................................................(.-.....(.-....}B..-.{s......s..N*L....9>.8.(.-....}B..-.{(.-.s..N*L....9>.8.s... =..F...W..(... =...........G.......G...................................................G...k...G.`.....G...1...G...A...G...W...G...^...G...o....................4..~...1...(...(.......C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.\.r.o.o.t.\.T.e.m.p.l.a.t.e.s.\.1.0.3.3.\.O.N.E.N.O.T.E.\.1.6.\.S.t.a.t.i.o.n.e.r.y.......S.t.a.t.i.o.n.e.r.y.........1.......S.t.a.t.i.o.n.e.r.y................s...c..,....................G...1... ..$....S.t.a.t.i.o.n.e.r.y................s...c..,0............)..'..K..?..6............4.......4.......#...Ne..G.......G.Q..H.$......2...H...........................(.-.s..4................................4....c..,....................G...G...1.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\header

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):72
                                                                                                                                                              Entropy (8bit):2.3347765773363713
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:bK9aaHtYRyv4lpaatl:bKXHtYo4xX
                                                                                                                                                              MD5:065C2CCB1AFF7F9DBFE373125779C06D
                                                                                                                                                              SHA1:EFE8C35E339975BFA3829FE49D3A2FD39FA0AD73
                                                                                                                                                              SHA-256:E9BEBA912B88D9E168228E66044A629F3ECA8BEDFD5EAA4B2842EBE94D19BD99
                                                                                                                                                              SHA-512:AF64725B433591EE19E8A6EBF53758F21B2B636F13222FA36C5329A26D71578B0A15427067CE720E912E0FAEC55EA352AFC9530860ACB452055DF8F537950469
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:...... :........Z..............................@.........-.@............

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000001.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):0.04401584019170665
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:RRk//:Lk
                                                                                                                                                              MD5:CD74ABACE8A00B17BD8107BC5982C21E
                                                                                                                                                              SHA1:D53193CF8A43D766FBFA52976192F44D6B0F79B2
                                                                                                                                                              SHA-256:B670BC07C9CB554511180DCF3F6A2C7818E8CE6E67B84784F0EA4D35EC61D516
                                                                                                                                                              SHA-512:1B48A37FCF0F9FB9ED9B31A8F3E36596689BF1EEC6F41F5EFA3C728121944919CE7A81F0379A108D80AA051CFEF07DC296F9C0691FC8855983B2F29EC15C7FEF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000002.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):0.49774734046982405
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:vldawlAuil8xt/l2lkt+K9qX/gU/t2kdcXltEo+Xl2hliJw5YUQWTk/lL5bOzWlF:NTcktv9OS1t+1GwJGTAI5w1EVzJIZ
                                                                                                                                                              MD5:5998E0B14383A6F22EAF1214C33F0039
                                                                                                                                                              SHA1:35F4B14BDB0AEEAA33FCD07CB5EADEF88B1E8F74
                                                                                                                                                              SHA-256:2FBE6DB7786E26D5B0931CE96B2345B839B304CE9E36FD463F7D6B8AA6BF7D0F
                                                                                                                                                              SHA-512:5E11B81505C38E883B84D983140A57E95123D22EF18790E790E8A08BE355A44F5D4B23458F40B6D005711E19126100D992AA5613B8C42DD8EEA1509CB2782C8E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>...........~....................................................................................................................................................................................................J..>o..................................J..>o.....................................................................................................................P..............................................................................5........m;.H....7.5N........ u&............m/u.9.F.lk...a!....N...^............................................................................................................m/u.9.F.lk...a!............................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000003.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.766314594572106
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:eHtnTzWxz3LPExyw0LQBlkw0L0qECL8E2fwEwL4l6DYy:2GxjzExyLUgLQqECgE2oEwcQDY
                                                                                                                                                              MD5:DAB72679A54A57908535A775EBE8C75D
                                                                                                                                                              SHA1:F10967EB4026C9335BFA013ADD93AE68B9D11CA5
                                                                                                                                                              SHA-256:87B996AE6E3C04C205917B75442B8F4C60429EC09107FC7A629B249B93688BBB
                                                                                                                                                              SHA-512:C55B8D34B9EA3B7A10711487D0F49C28352FFCD5FB38CB47BB780BA1773850453F062954CA66B34B4F1BA58D6067F8237291E98796BDA76AE9519FDFC9F7B13C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:j.......`.......L..................................................................?....................................................................j...............L...........................................[.#H...G.....H.......H....."*r.....C.|...',J7...C..le......9.z...m.le....H....."*r...(..H.....................................................................].r.....].r...6D...D..X4.E.......E....lK.>......2.......^.............................H.].r.........C..............T&....[.T$...].rT%m..#.~T.N...............".......h...E.T.:.......E........H..c..,0...e...B4.$..........C@RQ.H..B......Y....................#.~.....#.~^.}F.3....v............mo..-^.U.KH....[.....X^.&.6....[.....D......LV.[..#.~^.}F.3....v#.~.....>...............le......9.z...m..[.....D......LV#.~^.}F.3.................'.nm*.y...........[.....X^.&.6.....].r.....le...c..,0...e...B4.$...........I...M.....0...............................0...........e....4..................T.i.t.l.e.......|{

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000004.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):4.71115429105396
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:/s7uv4xkB+5Z8PXWACRi+F4aXxc1gLVi9H8P04k:0J6M5Kf7CRiwq0VqcP0
                                                                                                                                                              MD5:F5CD1A6629EE1087766DA6331C1BBEB7
                                                                                                                                                              SHA1:B59A893CCF74946D2BB0BC1DD1B25930D1EA356D
                                                                                                                                                              SHA-256:8DA0C0F170BB6F831CD80AD5751C4DF53B7684BF7A15DADD15F552807B413DB1
                                                                                                                                                              SHA-512:52DD0BFD69BED1688715FC1414A99C561BCB9ADB317ED6725B71EB19ACED4045C66A1B92506A4E2A6FB3FFCF121FF34E83AFD0C94F606458FF2329E127B533F3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......t...v...h...................................................................................................................................2...>...P.......v................................I.......I.qk..B.....LZA.%.4...A.%.]......k.V<.A.%.]......k.V<.A.%..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................U.x..'.;6k3pu....N...^................9..-tI..!.6...............>...............................$....I.qk..B.....LZ...............U.x..'.;6k3pu...........U.x..'.;6k3pu.........A.%.....A.%.....A.%.........................................A.%j....A.%T%;..A.%.....A.%..W..A.%H....A.%..+..A.%..S..A.%..........Z4...........................................4../4......p...............C.a.l.i.b.r.i..................A.%:A.%kA.%..z...y.. x.. ...........$...........7...7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.3

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000005.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):40884
                                                                                                                                                              Entropy (8bit):7.545929039957292
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:MCBOA4d+ElOXJ/3pI7cRBiL7L6qERqGz65WXzZqJsKQSbIsTT6XB:hIAU+2cGdLX6qBG4WDZl4Ihx
                                                                                                                                                              MD5:7379775A1E2AB7FAB95CFFCE01AE05F3
                                                                                                                                                              SHA1:3D3DDFD8AC7E07203561BAE423D66F0806833AB3
                                                                                                                                                              SHA-256:9301DB6D2D87282FCEE450189AEACE16D85F64273BF62713A3044992B6B7A9E9
                                                                                                                                                              SHA-512:4B5006E620E80D3A146944649CF4CA619782CAD7E8C4CD0D1DE0EBCA0FA05EACB7378DAFCEED3E26F5698B07F19604614D906C8F51F898660E2F129D8DEC6F62
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1A.....Qaq....".....2....BR#S..br...3T...C$.7(Hx....4D.G..Xh.cs..'..t...%...8.....................1...!AQ..a...q"2.4Tt.......R3S....Br...#s...Uu.bc.de..$D..6..C%E..............?...z...;sB.yv...........]t.\...n...../....m....M.=.3G+..x+.....S).*&.J../..8..O/+..sG...p...<!....~.c..C.w..,[oHom.wc-.J.~.......L[..6...'..i_..S;...!Y.z.q].EK..M.x...i.x.+.;.+...}....#......f.)........e6V..p.;........s.)..Ml.J......IU.6...<9+9.^..l..Y...[._...2..^..j.ia...._..3.;...~..<3...;......z.^.......]..Qk.,...Yk...3.3Jy^p.}....q...I...&..t.......;..9.g.GH;..'...%...)..[..y..../...zCn..>...'...1e.Y..;....]..7...N>t..m-.j.............H^..T\.q.ru...}...eTn]I'r.^].#..wOY....v

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000006.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12288
                                                                                                                                                              Entropy (8bit):4.427717426684559
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:bsOniKlVRJNTGAcEsRKqzB8LuE0lg184BVdop86Rpj9SoRKfgXKiKRkb7JMuZoNr:AkZlNdFFsRKyB4uEy4nBVdopfpj9SoUp
                                                                                                                                                              MD5:46AD159A57FA9E749681ACA489F5C73C
                                                                                                                                                              SHA1:A40EFAE70951B8D5D6FD8226C10BF2CEA13FA510
                                                                                                                                                              SHA-256:633ECDA7BB3F2BB2126658427D307655DB8ACC32599A0D2C43808360844115DE
                                                                                                                                                              SHA-512:D674F4EEB37773CB7C4CCB138E835DDA2B89803203C6464DFAE68A043163CCBEE5ECB030708EB901970B8BA91CF4DA2D144149C3BE4AD0FB59E59D0242021C33
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>...........v........ ...)..2...>...B.......v.......@....(...........................................................................................................................................I.......I.qk..B.....LZ....H........-..9.yl.S.......-..9.yl.S.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............Yl..G....V...;.....N...^................n.J.g.G.....g.=............................................"....I.qk..B.....LZ............Yl..G....V...;.................................................................................................j.".....T.................T............. .A............. ...........3...:...8.....z...y.. x.. ........ ..$...$........D..........7...7.........*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.1.5........................Z4...........................................4../4......p.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000007.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:19:29], progressive, precision 8, 221x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):24268
                                                                                                                                                              Entropy (8bit):6.946124661664625
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:d2wiieoHTRh5a1HAteZCWOZIM+L7WhNjYn:8wHFHJ+/OZIKhNO
                                                                                                                                                              MD5:3CD906D179F59DDFA112510C7E996351
                                                                                                                                                              SHA1:48CDB3685606EDD79D5BCDF0D7267B8B1CCBD5A8
                                                                                                                                                              SHA-256:1591FD26E7FFF5BE97431D0ED3D0ADE5CFC5FA74E3D7EC282FD242160CE68C1F
                                                                                                                                                              SHA-512:2048CBA13AF532FF2BCC7B8B40541993234BD1A8AB6DE47B889AF3F3E4571F9C5A22996D0B1C16DD6603233F6066A1A2A97C16A6020BEDD0826B83BAD0075512
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:19:29.....................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................$.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....)......[]t.\Z..g......A....&D.$LH._..X..Xl...`....cZ.X.........>......f.Z.X...]..~L.S..@..I$..I.IO.....x...s.g.[f.h{9..

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000008.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12288
                                                                                                                                                              Entropy (8bit):4.662862614366846
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:rsNPNEIXgiI0AY3uaGNhj/GUQEor/zKz+r5yXXLF5Rpq+SqRZxyXMQl9LYr9kVns:QMugiI0Kp3juUYTzr9MXLF5Rp5xMMQH0
                                                                                                                                                              MD5:586C31995EDF509DA134F7AA531E40D0
                                                                                                                                                              SHA1:2C3446BFDEB698ECE34411FCF619021BC0D2CBD4
                                                                                                                                                              SHA-256:E055CE5872B4CDB9E451B7560B859DCB17F4B86D3A2EA7222816804954FE8B41
                                                                                                                                                              SHA-512:1704A1FFC27D9B42A449C48DC07A76B300467A33539D8F7844ED6420FDD060E5D8E1AB62E321C7EFDA27AC593FB26CF8F7CBD646D25FC66BF5A9A9CCE3FD7426
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>...6...z...v...N.... ..X,..2...>...........v.......@...H+...........................................................................................................................................I.......I.qk..B.....LZ...N......!...'...v.e...!...'...v.e....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............w...S.....i^i......N...^.................R.%..K.Dq..lyJ............P....................................I.qk..B.....LZ............w...S.....i^i..............................................................................................j.9....T..............s....H........0......`.&............3..:..A..8....z...y.. x.. ........ ..$...$...............7...7.........*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.1.1................Z4...........................................4../4......p.........

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000009.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):39010
                                                                                                                                                              Entropy (8bit):7.362726513389497
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:6tCjwO+E+KW0ZtOgepcoWW4pAWQ6/KWcR474HOAZaDfK:68j+E+KW0HOgep/72/NKWcRNefK
                                                                                                                                                              MD5:9700DE02720CDB5A45EDE51F1A4647EC
                                                                                                                                                              SHA1:CF72A73E1181719B1CC45C2FE0A6B619081E115E
                                                                                                                                                              SHA-256:7E6A7714A69688D9FFDF16AA942B66064A0C77FCD9B3E469F89730B4B9290C3E
                                                                                                                                                              SHA-512:5438921467D62376472007B9EBF3C35C9D9FE3EDE04D99A990129332D53EBC8EE2555C0319A4F7C0DF63516F29CEDF2171D8B6DC34C9FCD075C2CA41EB728660
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!1..A...Qaq..".......2BR#...b%&6..'w.r.3f7W8.s5EUeF.g....CS$4.Vv..Tdt..G..(c..u.Hhx.......................!1.AQa..2.q....".s...3.4BRr.#......b.$c............?........uf.....t...;..[...W.h.....-.k.f..i.u..KQ..b.F...rM%/.8n.S..=9.....G$O;.f.}L..N..U._i.[.X...3.~....S.~..+t$...c.5......{..X/..#.G...}s....6......^....o~.$.\WA?...^*w[O.~..6..~....a....~..:..0.......{O...|.s.u._w.........i...........{K...._.?.../{.....A..8....<g.iu..<..................X......|]v....D..9.k.w.|-IF.Tv.-.&.........."'.4.b....z.._.Z.....G...u.xyt./_.q..m>..S.V.Xdc.bw.T.W......g..........}s.._..?....U]_.......`......>.|'.~xH....,...?........?.q....o../..R..;...Y.G....A"?......?.<..1...w..o.M.........tco.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000A.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12288
                                                                                                                                                              Entropy (8bit):3.894905308868054
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:XGsHhqvc9DmEE+0Ip0AReSgd+ifHrUmB83whckSYYU1fk+cXc1l1:XjHhrD7Xr+ARe31UmBWwhcdYnByC1
                                                                                                                                                              MD5:3C0F0F2A64541EB15ED2E2C6A95F4D1A
                                                                                                                                                              SHA1:1539AA0D79DA3FC6CE0D546DB296B288642E7EA5
                                                                                                                                                              SHA-256:6B96E207F520499C48891B12C259AB8CA70182BF7E67827E861931E12B82AC09
                                                                                                                                                              SHA-512:3D3CBA3FB8A5C821096D7E235B85D7FF6272400AE7C940FF6AE7AC6279199FDB8A4D076BED923F9C7AE6AAF769980FBFE3E3CE6868B4F8B1859B5006E9155C00
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....>......."...v.......8 ..."......>.......r...v...>...@....!...........................................................................................................................................I.......I.qk..B.....LZ.j.......j.%2?......T.J.7.m3.k..2.L..w.?7.m..j.%2?......T.J(.j...I.qk..B.....LZ.I............I.......I...................................................I.t.....I................................................................4..'...'...............Yv........z(._....N...^...............9N.HY..E....^..,............(...............................z....I.qk..B.....LZ..............Yv........z(._..................................j.......j.......j.........................................7.m.8...7.m3.k..2.L..w.?.j.......j.%2?......T.J(2................................I...............................7.mH....7.m.....7.m..d..7.m.....7.m ....7.m$.7..7.m.....7.m ........7.m!7.m..z...,4. ............................"......$...7...............T.u.e.s.d.a.y.,. .J.u.l.y. .2.8.,.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000B.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):59707
                                                                                                                                                              Entropy (8bit):7.858445368171059
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:k76rvGc8WKC2/UX1uEgVRY/jvv9CblyL/T:k77Z5C2/Ow1e9CblCT
                                                                                                                                                              MD5:47ADB0DF6FDA756920225A099B722322
                                                                                                                                                              SHA1:851946B8C2BD0BB351BAEECA9E5BB6648A87D7CA
                                                                                                                                                              SHA-256:EC8CD7250F3D82E900E99114869777EE859EC73EFFABED108815F65742078C3A
                                                                                                                                                              SHA-512:85A9920E1CE4A2FCCEBAFA425C925DF33580FA3C3C00178F058539B2FBC0163866DB8A41B320E2EF2CD217F00FFA06A1A831C728D3F9F910C9EAC58B5DA76E2D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..A..Qaq"....2........B#..R.b3$..8xrC4&'W.%e.(.c.d.5E6Ff..h..SsTt..u...Gg..H.....................!.1..AQ.aq.".......2..st.BR..56.r#3.b.S.4c%...$d.CT............?....3.7...G:../P....z..K.:6..w......6....... .z7...~.....{gdF60...9....{...'[N....m.........z...g{.......7...4..1..=.z...._..p...m..Icd.~.v..9.P..0Z(.<j.......R6zm.....v.z...>x..)=g........zo{..w..f..y.t.....%.D..#.}.I.>).H.QM..cLD..x.../.^y.{.............y.=^.......I.T.......U..0_?...u..og..3.ky..K....6w...Dc......~........ik.z....N...en......_.....x....._u...4.{..P...>.....}.......>.R.....m.....[mt.....}.........|.....m......~....B.F.]C.36..q....yg...{]...+.DZv.9<.o..;..N.n&im.,....w.3...V.s...Y..e#$.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000C.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12288
                                                                                                                                                              Entropy (8bit):3.8769451002854733
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:oC6seWs5bLuzyucVqXJrRlmehpCs3Ay9l0O0TQ:oC3e/umucVkJrRlxCx6l3
                                                                                                                                                              MD5:3FF8B62E78EB34E71AB8D793981144C9
                                                                                                                                                              SHA1:F9565E115BABF35402E9B5B20C1F7CA640E59666
                                                                                                                                                              SHA-256:4393A22B5914EB81A8A0342D6951E60E8A5DE081B3D460520614F7191CC8BB79
                                                                                                                                                              SHA-512:38C2057225AFCEA897A1F6F22BF8350F35D5DEB4DF99219AE70B09ED9E47F0EFFC437817119EB99DCED9855A77E84321F414FCAA9A6EF6858FCC46862C08C258
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>...........v........ .. "..2...>...d...<...v.......@....!...........................................................................................................................................I.......I.qk..B.....LZ...<.........m$...4.......m$...4.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............J.K.h..7..)........N...^....................E.G.Pf................................................D....I.qk..B.....LZ.............J.K.h..7..)................................................................................................j......T.T............|......;......h........... .W.....'..2....z...,4. ...."......$>........4..p..7......S.u.m.m.a.r.y..........................3..8....z...y.. x.. ...........$...........7...7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.9...............

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000D.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:18:09], progressive, precision 8, 164x641, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):27862
                                                                                                                                                              Entropy (8bit):7.238903610770013
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:LTawAZvhbrXzDc6LERLQ/b5vXOl6pXQ/wD5OUMrdRUUhCplQg0ESSz:6wm/vT/b4wxoqbdUhWnSs
                                                                                                                                                              MD5:E62F2908FA5F7189ED8EEBD413928DEE
                                                                                                                                                              SHA1:CA249B4A70924B73BDA52972E9C735AEC35A0C5D
                                                                                                                                                              SHA-256:20ABE389C885E42B6EBE9E902976229BB6FD63C8C34CB61AA70B8B746209F90A
                                                                                                                                                              SHA-512:EE8D1821A918BE8714F431895E7223D08036E88A4FDB9A5485EFF246640EE969A69A8AA4E2E9DDC35BA75FB6D4E95092A286E90B477BD6998C313639C2C31F25
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:18:09......................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................!.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..P.v..+..n(a..Q..S\6....Y....D......} w#.b..]l.5.RU..k...... ]$.$.........f........?.z@2uU...7....?..|.Q..I.&.. ......"T4)wdH.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000E.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):20480
                                                                                                                                                              Entropy (8bit):5.309490987608
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:mhKWTa9bTU4oO5l0XxTUPmZX524yVAOqqY8ZcKQ8wDS+dy0ly4DGg4Xg:mAVpb5QpjRYsQl
                                                                                                                                                              MD5:2402B4C574E4F265BBA4A11780A30FBE
                                                                                                                                                              SHA1:25F0DD32498DA90DEBF9A008CFA38D62780C887E
                                                                                                                                                              SHA-256:1E4CC8667E8B7642F137A6760925FF629A5BA14B915A69EB850C53F9D13F89AB
                                                                                                                                                              SHA-512:9173E2691947F6462A8319C8B99C2D2D76517F6AE1AD8D9684AAE4947C44E5B1BC480BB3A2F338787D022EE2EEA5629495447D68747B5CF2CB26229FC319A519
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:...@....0...........H...(@... ..@L.........@................d....J... ...K.................................................................................@.....................J... ..`K..............>.......>...on...Y..?..A.,.......,.T+...0A.... ...v5.:6.....m.....v....c...=.....I....e...s...2.l{.Pcie.............).......).....................................................T!......T&2..a@.T"6...K.T.N..T..T%M..oy+T&H..j.9T#}..%.CT!d...........0...........e....4.........................A..:4E.2..p1......(...`.i.....(...(...B.a.c.k.g.r.o.u.n.d. .-. .Y.e.l.l.o.w...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.r...P.a.g.e.V.e.r.C.o.m.m.e.n.t...P.a.g.e.O.v.e.r.i.d.e...P.a.g.e.N.a.m.e...2...0.0.0.1.9...1.....0...U.n.t.i.t.l.e.d. .p.a.g.e...^.......^..7.....7..P..O...............H.mf.....2...L.......x...................>....,...m..ML.......K....0...............0...........e....4........................yf.....F.Q.........(...pO;.....(.......S.t.a.t.e.m.e.n.t...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.r...P.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000F.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.120152148925155
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:Yxs5669IwQlLMPgEauqXm9CjbTgRLlMD9Iv5792:IsTfQlA9auqXm9CnERLlA
                                                                                                                                                              MD5:51758B35522264F111B4519364CD3C5E
                                                                                                                                                              SHA1:F0D718001DFAEC2090833C6AED77687F126D1842
                                                                                                                                                              SHA-256:8017031B4261931A744B246AF9146DD955CBCF9A7564C6A736380A9AF0426A39
                                                                                                                                                              SHA-512:09C02E3F260DA022E0B7B00E8BB43A8B4F2715C468D3E7AE3B71955BC51EE09ED5E228287D626B8F1074897CF9F772F0DBB3CED252454E286A1A6F2E0E05089C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>....... ...v....................................................?....?.............................................................................2...>.......|...v...H............................I.......I.qk..B.....LZ.[D......[Dg..<.).%ak.&..[Dg..<.).%ak.&..[D..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................1..#.....}.....N...^...............N..hx5gB....=..n........f........................................I.qk..B.....LZ...............1..#.....}............1..#.....}...........[D......[D......[D..........................................[Dj.....[DT.]...[D......[D..B...[DH.....[D..B...[D..>.).[D..J...................;........4...4...4.."...............[D..[D..[D..z...y.. x.. ...........$........4......7...7........................;........4...4...4..........[D......[D....#.[D............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000G.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.087815809535008
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:xsYs0g/iR9sEAXM9KwTSRy2hBN0gkAse6g:xsYs0g/iDJAXM9Kw+RycP0gkAseH
                                                                                                                                                              MD5:C3A7EAA421437C877E2718EF4279FB50
                                                                                                                                                              SHA1:BF61CF67C5709346CAB51FE92F2FA0E891484D8F
                                                                                                                                                              SHA-256:99D0CBDA1920F377992FDBF5DD692725D0026C573498DCE2A4D99220A81A8B65
                                                                                                                                                              SHA-512:99B39F53F6D47B49A6D5DDCBD9D288A13BACA2BABF692EE81920656B93B0487A5373D945C438C25EF3686C700C35EC968984BD6001C93E97F28B999E5BFB657B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZ.N.......N...z...&L..".N...z...&L..".N...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............G...0.!.!Y.O,.....N...^.................6.2..C...p..P.........f........................................I.qk..B.....LZ.............G...0.!.!Y.O,..........G...0.!.!Y.O,...........N.......N.......N...........................................N.j.....N.T.]...N.......N...B...N.H.....N...B...N...>.).N...J...................;........4...4...4.."...............N...N...N...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........N.......N.....#.N.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000H.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.077403912778597
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:aOVsUUcILC6ZtyDoE3pCXI9sAToXrd6rw8IcdXYPrY3OQg:xsuQC6ZLE3UXI9sATaRiryQ
                                                                                                                                                              MD5:1A6BE5301DCE5BC1CB176F0C0334605C
                                                                                                                                                              SHA1:C5B9240302D333D67B10F802FC67EBCCD8A7DC8E
                                                                                                                                                              SHA-256:363CF0CA4F3B97E97532398B44C7FDE26C23EFD1359386B1B77354DC551B201F
                                                                                                                                                              SHA-512:AE6AD8DC8A077FEE2FE0CB38B9E6D9B1EB8D91AA25910F4764CEFB5AF20D80C34B42CA58F9CBF39AECF7BB6A4973C222D68E766C0EC98C15912E96A4C2E42AA3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......$...v.......................................................................................................................................2...>...........v...L............................I.......I.qk..B.....LZ.............B..l>x./<......B..l>x./<......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................F.#..5...1!b....N...^................1#{a..M.[a9...........f........................................I.qk..B.....LZ...............F.#..5...1!b...........F.#..5...1!b........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000I.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.053034352083881
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:ZsqVRSjU24dVtOcokElRX891SbKToJrdnrnQIj/2dX2p3qUz6kiK3N64qg:Zsxr4dV0cZEbX89sbKToRrn1OQE
                                                                                                                                                              MD5:64D62F930EF1FFF6A6F3C5974E4BAD91
                                                                                                                                                              SHA1:3C32DB1A9EDB48CF25BAEF361E550BB7CEF48567
                                                                                                                                                              SHA-256:E49119417FD3090F78745A0A403A0916CA1D35EC5C624EF81FEDA2AA0AC1E051
                                                                                                                                                              SHA-512:5A203D270A8A7F5F85921E9D14AADFAF995B2635F777F76D5FB9DFB61BDEABBA2F3C0C9713155C36469DA8152FA550CFDCAFDDCAB15F06C4F9716CD492B285B7
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......$...v.......................................................................................................................................2...>...........v...L...........................8.......8.......T....`(.I.......I.qk..B.....LZ8.......T....`(8....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............SR.d!..%..I.......N...^...............NrU)..{F..a...........f........................................I.qk..B.....LZ............SR.d!..%..I...........SR.d!..%..I............8.......8.......8...........................................8..j....8..T.]..8.......8....B..8..H....8....B..8....>.)8....J...................;........4...4...4.."..............8...8...8....z...y.. x.. ...........$........4......7...7........................;........4...4...4.........8.......8......#8..............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000J.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.06284792348101
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:a32sC4cPbXVUAeRI56xt07eMG9PEHhcXY9xQengTToardqrhIfdXFjzvzHsUNvc2:9sRvIQx20BEHiXY9xRgTTHRy+Pps
                                                                                                                                                              MD5:297FA6766300278C5570D3635558B20F
                                                                                                                                                              SHA1:D6B1024ADA47119772B403B52B593394F8F336B1
                                                                                                                                                              SHA-256:D3DACF44D9898E19C0DFDFC773A8490A73F8EF62CB118896D4D0137BA0C94A62
                                                                                                                                                              SHA-512:B0D8C6D4DE3A855FD545DBE60E4ECC2A52B3249D031C7C4F5FEA7148CE54733720385FDA6253BA2618683A29583D826B17751B738F088370506B0A9104D28F37
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......$...v.......................................................................................................................................2...>...........v...L............................I.......I.qk..B.....LZ...........[ .....c.~......[ .....c.~........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............y.j........B.....N...^..................6.T.A.C..?8t.........f........................................I.qk..B.....LZ............y.j........B.........y.j........B.........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000K.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.0902879491192925
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:YAQNs6hz63H+tTuaEEyIXbI9jjJRToordDr6IldXD1vRs5Elt:2s+63etVEBIXbI9JRT1RPJfbl
                                                                                                                                                              MD5:69BE88591AFFE33E7AEB53900411197B
                                                                                                                                                              SHA1:31ED2D1735813430DE7F40E982FD2FC7ADF1682A
                                                                                                                                                              SHA-256:BAA7A3FEB411159684F1DD9BA30CBD19AE61950B8D013595DF9F3EED0517CED6
                                                                                                                                                              SHA-512:BC907AA8D8D2F57F7C04F54F256209272A22918F063E488760DB3FCBAB4CEE3CCBF2E11D1771A5D84D606E7F26CB04B673977C0B9D98FC4019F166B72B519639
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ...........f=...?...#......f=...?...#........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............H...w...#..+d.....N...^...............\.;..E.D.!.O.E..........f........................................I.qk..B.....LZ............H...w...#..+d.........H...w...#..+d.........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000L.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.054531323985192
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:asH2R6wlREYrXE9eAsT6R2DUPjGJQPZsq:asHC6HYrXE9dsWR2DUPKJQPCq
                                                                                                                                                              MD5:BBEC8C1642A2AFA43FC488A206A94874
                                                                                                                                                              SHA1:37CA26BE9FE11511F0FDDBC2E407945F0DE2AFDA
                                                                                                                                                              SHA-256:95074AED3F8C29B94695A020670D8B6892439DAD8291029C76F8F1EF4CFD7B7E
                                                                                                                                                              SHA-512:A0942D90BBA447EB8C9C2C50E7A0A15BE02AE8A5DDC333920CEF746FC42D1C336D47F5EBCF8A40EB282CF77882A59764DFEBA01A821BB8B4C85EF5EF16A3D060
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZn.h.....n.h..b.....T2../n.h..b.....T2../n.h..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................7..75 w.3......N...^...............%....`<E..P.p. .........f........................................I.qk..B.....LZ.................7..75 w.3...............7..75 w.3...........n.h.....n.h.....n.h.........................................n.hj....n.hT.]..n.h.....n.h..B..n.hH....n.h..B..n.h..>.)n.h..J...................;........4...4...4.."..............n.h.n.h.n.h..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........n.h.....n.h....#n.h............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000M.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.051099789171122
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:Y4xr0sgMdvlUhvSSiti9CEn6rNXo9OYhToRvCrdvlxrDEIxDdXbFRglIIw+ON:tr0sGBSSiYkE4Xo9phThRHrDh
                                                                                                                                                              MD5:4D6BE84B5FDF6CF606E08EED28E83BFA
                                                                                                                                                              SHA1:CF1B571C2034C1482DE7551C06FA591B5ECED33A
                                                                                                                                                              SHA-256:BD319092FB2E546009BBA12BD5BE016536796E3D22386282679CA87E8145AB3D
                                                                                                                                                              SHA-512:D1A88545F85DEFB28A3340C29FD780C924C66FA17D54AC29B09E14A73358FB31F7EE3677B740B738088A895EA651D5040FA72551A90BD9FF2A7C31E2E736AD35
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZZ6a.....Z6a.K........ix'Z6a.K........ix'Z6a..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............'..V...\.#n../....N...^...............i....?O......=.........f........................................I.qk..B.....LZ..............'..V...\.#n../..........'..V...\.#n../.........Z6a.....Z6a.....Z6a.........................................Z6aj....Z6aT.]..Z6a.....Z6a..B..Z6aH....Z6a..B..Z6a..>.)Z6a..J...................;........4...4...4.."..............Z6a.Z6a.Z6a..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........Z6a.....Z6a....#Z6a............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000N.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.050155251991838
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:YBsdvYCOvgvyzHAODO/mjtG6EXgZ8Xo9aBWFToQrdPr5I0ArdXPdRdvgvhoVv5vN:KsqTAODO+j3EXgqXo9wWFTFRjdArJ
                                                                                                                                                              MD5:A7B361B20C3906308A7DA92326A46B61
                                                                                                                                                              SHA1:EDCD1ADB6078BF24F98EDC672895286DFDF6577A
                                                                                                                                                              SHA-256:465E60921786D42C655F5EB06A111A702C20050DB5871B2D4503203AED6B54AC
                                                                                                                                                              SHA-512:995481982EE3DFB43FF8E1DDE3157C2B687675C70F6B3DACF36A6B1AFF59D34D59049CD8C127627E0999D5FFFBCB11ADF3B4D85145DD48D1FFA6AA9F48B7C19C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ..e.......e.....8z.j.....e.....8z.j.....e..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............+H...A..y+....+....N...^...............i.PB.`.D.x...H..........f........................................I.qk..B.....LZ............+H...A..y+....+........+H...A..y+....+...........e.......e.......e...........................................ej......eT.]....e.......e..B....eH......e..B....e..>.)..e..J...................;........4...4...4.."................e...e...e..z...y.. x.. ...........$........4......7...7........................;........4...4...4...........e.......e....#..e............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000O.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.073076872546607
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:ysTIh0MOnvEfXc9rXxLThxRI/mZTEaZOXE:ysTu0MOcfXc9rBLDRI/mZTEaZcE
                                                                                                                                                              MD5:288424A1B4965C8986AEC25B8085D988
                                                                                                                                                              SHA1:146A1916883C1C7E37BB1BDB3B6C937042B8595E
                                                                                                                                                              SHA-256:56E0D62323A121917E747B576E077CF2377C30301FC4B7D645E6C406D2861F68
                                                                                                                                                              SHA-512:7B3A5D0CA537B8B9E79A75A61BE7D6AE851C9179E1C892C10DD088FC65FA172568274A390C4A044D18D384D17322B883FACB5F4E42957FD3AD4176527E5DC691
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZVWt.....VWt...I......DF.VWt...I......DF.VWt..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............4.......Gg..8....N...^.................%..I.K..P\...6........f........................................I.qk..B.....LZ.............4.......Gg..8.........4.......Gg..8.........VWt.....VWt.....VWt.........................................VWtj....VWtT.]..VWt.....VWt..B..VWtH....VWt..B..VWt..>.)VWt..J...................;........4...4...4.."..............VWt.VWt.VWt..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........VWt.....VWt....#VWt............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000P.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.090298426777373
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:sDs9sRlFK+KepEfZXA9R7TfRf51s6smasisbs6sUisds:ysWbFWeWxXA9R7jRf5+pUBgpC2
                                                                                                                                                              MD5:E0AECB9BA5E441A1CD912220763E62CA
                                                                                                                                                              SHA1:C6DDDF88EE55D8522ED1834C37F88A3A0D402004
                                                                                                                                                              SHA-256:007D48C9C299133AD24448709685FCD25CB60A6E42E04494D5F31DEFBCCB017D
                                                                                                                                                              SHA-512:A3D1B1CB7BD78DDD16BF9D3A0EBA31AB3DCCE2617C9BEA112AC7E6102DA483709B05DB08DB9FBEA214C8D703B338ECE772E668E80178C5857036CFC76027982B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ.........SD......^..5...SD......^..5.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............%..YE.r...%.2.......N...^................U.....@......a........f........................................I.qk..B.....LZ............%..YE.r...%.2...........%..YE.r...%.2.......................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4......7...7........................;........4...4...4......................#..............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000Q.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.079846611025151
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:JoDsEvfX36zGPEFEXn09hzNTlReI6WqTe4n:yDsEvfX36zZaXn09hzNhReI6WqTe4
                                                                                                                                                              MD5:2E4A45C7C37868B1D04734834670BEA5
                                                                                                                                                              SHA1:E5FC32C637F9932195525C0BA611C49A3DC48633
                                                                                                                                                              SHA-256:BCEC89D3C797F9BEA20B814ABF37712EDAE364AE2233D9A7740AEBF90E6F38C1
                                                                                                                                                              SHA-512:0722DB7F7773E81F6B57E019F61D3C607D0BAD271673139FF0D8EB02F94E63F6CF5527899DCA94FF961D9E0306D24D521FADA47F363D643A80340D0BDB5EC68B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J...........................{g......{g.....?..';....I.......I.qk..B.....LZ{g.....?..';...{g...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............a.....^.....'.....N...^...............A..-...G...;. Lx........f........................................I.qk..B.....LZ............a.....^.....'.........a.....^.....'..........{g......{g......{g..........................................{g.j....{g.T.]..{g......{g...B..{g.H....{g...B..{g...>.){g...J...................;........4...4...4.."..............{g..{g..{g...z...y.. x.. ...........$........4......7...7........................;........4...4...4.........{g......{g.....#{g.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000R.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.100375719848043
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:lXzsnQrtuV8E4KXtZ9K9mZFT3RfH62yk:JsnQrt8ZXXtZA9mZFTRv6M
                                                                                                                                                              MD5:B8FADB8E5C6179C96D26107872B7CF1C
                                                                                                                                                              SHA1:435D411C5830F2200CC3A723DE9FDF244D19A033
                                                                                                                                                              SHA-256:7FAE692398DA477C589F124CF906F9B1D1DAB0A2D533F78CC149CD90E227D9F0
                                                                                                                                                              SHA-512:F16489007EA5A7C144EAEF7D059E3DAEFB7294C00D5D8E987C09BC8405B2FDD3FC354B76639E6F94E6EBF0062BBA1CAF4B0F8D5BB5FCB239F14157DA65FF415C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZ..6.......6.u-..?......h..6.u-..?......h..6..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............X*.bsJ. .\/.C......N...^................v..#(TI....."..........f........................................I.qk..B.....LZ.............X*.bsJ. .\/.C...........X*.bsJ. .\/.C.............6.......6.......6...........................................6j......6T.]....6.......6..B....6H......6..B....6..>.)..6..J...................;........4...4...4.."................6...6...6..z...y.. x.. ...........$........4......7...7........................;........4...4...4...........6.......6....#..6............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000S.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.093544699707061
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:tspV6ozMbocERXsd9SiTwRpuaZW3b6fWmsVd3:tspV6oYo5RXsd9SiURpuaZWr6fWld3
                                                                                                                                                              MD5:EDAE92047CA19C7609FCAFAACB5466D6
                                                                                                                                                              SHA1:2D722E848BB25F7AD909B1C03D36F250D01FE153
                                                                                                                                                              SHA-256:7A39888E13DCAFFADF71C456E69BD71D57463A9BE3A2CA956C9E7D691DA8D3DF
                                                                                                                                                              SHA-512:D700326251040206AE1C3134D0E5E5728A3ED8B8F7A44C0AE9EC01380A869EB18685E622D598EED11166F34D0FDA265FA6BA0BA1B1451218D8CE869D69C51AE4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZ...............>4..!u.8.......>4..!u.8.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............*..GI..............N...^................+.....J.EV.{..r........f........................................I.qk..B.....LZ.............*..GI...................*..GI..................................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000T.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.08832767112544
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:Yesw4n+UhDjHmtxtoEdrXwh9n+1fdTosNrddr3IZdXfmkiyfsa:Ns7jHmhoEZXw9n+1fdTtRRawl8s
                                                                                                                                                              MD5:AC953C9F74A71B6D4C7A5C5035107E32
                                                                                                                                                              SHA1:5FAEB151D8A8184455838D33BEDA375FCDAACE8A
                                                                                                                                                              SHA-256:8C8573B73B8C0A4885D4B9E3DA97DC5C8EA1AEB81238D3863EBFBCEFD87A2F9A
                                                                                                                                                              SHA-512:9F6BAF3986F2BE96F8E250CC8AA9A4C3FD57374CCECFF83F5B545F5CAFDA97A35E1169CD0FCD1020B0D1BA2DA15C9D6B576D43EDF84DAA57713A2E8ACADA3A4A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZY.......Y....lx.....z$.IY....lx.....z$.IY....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................|.....}.-f.......N...^.................{L.7%@..P@+..........f........................................I.qk..B.....LZ...............|.....}.-f..............|.....}.-f............Y.......Y.......Y...........................................Y..j....Y..T.]..Y.......Y....B..Y..H....Y....B..Y....>.)Y....J...................;........4...4...4.."..............Y...Y...Y....z...y.. x.. ...........$........4......7...7........................;........4...4...4.........Y.......Y......#Y..............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000U.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.169498673138827
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:isPFqGRuAN0tUE4Et0LX4L9Ka+ToNrdjr2IidXGHhRqXmwoxig:issAN0KhEWLX4L9Ka+TcRvq0
                                                                                                                                                              MD5:9EE855B59B3EF84CF490086E1B3C5930
                                                                                                                                                              SHA1:3B77D7345F039F4CD1D67CF6321F8C59A8FD07E5
                                                                                                                                                              SHA-256:1C6EF4AD40F8796090F6D42071D5BC53F4684213EEAF79A8E85DF2FD1264229E
                                                                                                                                                              SHA-512:463461B71C323AF4E61FDA5CC576CDED81550A18802E796768DFF56DDB929852FC7CB1FBCB859BFA7BF3BF8741F3275BBC9A989D3DDDC3B8DAB0E0EEF88B8C60
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......0...v...$.................................................?....?............................................................................2...>...........v...X............................I.......I.qk..B.....LZ..............c...Q...H.......c...Q...H......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............$..oQ.......b.....N...^...............U.L.T^2J.e...kS.........f........................................I.qk..B.....LZ............$..oQ.......b.........$..oQ.......b.........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000V.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.1769515329533515
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:ms8PUHAVaLtNtUEPlOlzX+z9sWUxTourdQrSpIcdXsTPcAlpig:msmVaLFUEPkXM9sNTrRIaiV
                                                                                                                                                              MD5:F31EDEFFA3FE338B9BD5FB8C3B23FF9E
                                                                                                                                                              SHA1:883B90B1EEDFBF092F5E07AA3EEC0DA0C4E4B3F5
                                                                                                                                                              SHA-256:642B1FA791B62EB6F33A55E52AC9B1BB7E62D4EE742E71CE09C132FF85B924A2
                                                                                                                                                              SHA-512:9ED812832FD0B0D62746A9B959CE44431DE51C3B5C28C6B6AD65712FCE1AE592691BA99657B4BA3B22A69E54EC7537F79AD332F5A26865615CBE8FF05941466B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......0...v...$.................................................?....?............................................................................2...>...........v...X............................I.......I.qk..B.....LZ.........Z.l .?..L\.u...Z.l .?..L\.u.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............EIc.&.....<..+.S....N...^.................yI.!A.ts............f........................................I.qk..B.....LZ............EIc.&.....<..+.S........EIc.&.....<..+.S....................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4......7...7........................;........4...4...4......................#..............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000010.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.109566310649376
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:uIsQCd/7mKGmNSOtO7OEBAC+reXY59DFVvTo70rdSrK3IxdXn61pR:uIsxqKTNSOMyEBA7CXk9DFRTo0RKXe
                                                                                                                                                              MD5:E1CADCA8EA9F073CB786D7645E18ACB4
                                                                                                                                                              SHA1:7EF435D2D5AABC2AFAACE1EA6B6B81562BC61314
                                                                                                                                                              SHA-256:E58C855E0DA335A05DDC5E7FB4379F7038C74FFE5D7414A332EF8F0A09D2732F
                                                                                                                                                              SHA-512:D518C304B703D1F841B4DAE776649092E9527CF0B41CE895933ED02C76064A538B246EDA0B6D52382694BA77168F95406C71B52A91082E6F00E128E6A7C3729D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZb#......b#.J..p.......XXb#.J..p.......XXb#...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............h.Q...j...B...%.....N...^....................FH....b.i.........f........................................I.qk..B.....LZ............h.Q...j...B...%.........h.Q...j...B...%..........b#......b#......b#..........................................b#.j....b#.T.]..b#......b#...B..b#.H....b#...B..b#...>.)b#...J...................;........4...4...4.."..............b#..b#..b#...z...y.. x.. ...........$........4......7...7........................;........4...4...4.........b#......b#.....#b#.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000011.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.107645010965627
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:1s+cHDKnc8E7dX09+TeRKwtbcc+7bcrxR:1sZHDKcZRX09+yRKw
                                                                                                                                                              MD5:6F80C36B7ECCFE2353555C138D135610
                                                                                                                                                              SHA1:4F7CB94C72E3D9C5D1EAFFC649D29FC9FA58AE8F
                                                                                                                                                              SHA-256:05F01DA8DFE45BFB86CD6D8FE0F928EC2BCC81E8CD9F0C6AEF6F031101D8F34C
                                                                                                                                                              SHA-512:D676E59C582AE1CEFCC893138ED9EC4A702E64CF3A2BB1A57F6AE80C82FD5014320DC22230DA556EDE4DEE422209AE9D54965690B38BC71308DC68FB7C8E5123
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ................*J.<..........*J.<.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................Fl..)ke.5.g*....N...^.................D....I..1.;9..........f........................................I.qk..B.....LZ................Fl..)ke.5.g*............Fl..)ke.5.g*........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000012.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.106333944248599
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:Fsq/rgrBsdteuoWEEC/WYfXbPYf9S95r68ToZrdSrnIadXKemGpt:FsPBsdgqEEkfXbgf9i5rzT8RKRJ
                                                                                                                                                              MD5:71FBB8684A6B1E5B0135D6EC04EFA194
                                                                                                                                                              SHA1:EF5ADCBD9029368596F315D5B7FA735E50B8A1E8
                                                                                                                                                              SHA-256:F4D6C3035032B8292AB3DF3A65A1F28C688A2BA04C4E862195C09A1510BB3E53
                                                                                                                                                              SHA-512:015528AA5F6259BA25C59F2DBCDAACB139F4A40B22CB35453412D80C4BC54654114BECFD10D288C8ECB5D332346183B46E458118823758B97DE82AD784BBC6E5
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.~.......~..4....s..S..?.~..4....s..S..?.~...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............cNH*.I.......k.....N...^...............o...#&7D....o.........f........................................I.qk..B.....LZ.............cNH*.I.......k..........cNH*.I.......k...........~.......~.......~...........................................~.j.....~.T.]...~.......~..B...~.H.....~...B...~...>.).~...J...................;........4...4...4.."...............~...~...~...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........~.......~.....#.~.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000013.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.122931646988241
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:BsVSlZ0sBaEBt8+E2CHvkXvk9zoToTJrdSriI2dXyJVCds4kdPwKvWVrc81:BsVtsBaEBZE2UkXvk9UTERK6Ls9PpW
                                                                                                                                                              MD5:FFFF98969F50527BE7B7F2BEA4CC45B2
                                                                                                                                                              SHA1:7B6FE8883381C40713F4EC940EAA0CCD5712BF5B
                                                                                                                                                              SHA-256:461AEDDA573B4FF61D60CD4992E02A4BE10C3ED3AABD2C02A36ED32463176019
                                                                                                                                                              SHA-512:70E00556A461A527EBC60D85326A770DDB59E2EE709402326BC5CA3E1826308FF94BC786BFC6E6842CE13D69B35CE85C68378318A57790D232B512311C418E2A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZf0......f0.U..].7.......f0.U..].7.......f0...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................In...'.b...o.....N...^...............~.]..-.F."'.............f........................................I.qk..B.....LZ...............In...'.b...o............In...'.b...o..........f0......f0......f0..........................................f0.j....f0.T.]..f0......f0...B..f0.H....f0...B..f0...>.)f0...J...................;........4...4...4.."..............f0..f0..f0...z...y.. x.. ...........$........4......7...7........................;........4...4...4.........f0......f0.....#f0.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000014.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.128690181451724
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:XeSsOBr1z2SNitmz7xeEG9CCZPX094SSTonrdSrlIsdXUDxpxISEmlMpxhQqX:hsIz2SNiM8Ei/X094ZTyRKVAzo
                                                                                                                                                              MD5:2727AAE970CF21F519475B7D1AEF63DE
                                                                                                                                                              SHA1:F3A870A835E8785559B460FE2F61E5B234F9779E
                                                                                                                                                              SHA-256:4079F6334880C565893AC6CB60769FCAEAC4D8DB6F294D10F56C13248EA2C829
                                                                                                                                                              SHA-512:C51BB4FEA920CC77C55CC56AB2B5A9C39A9A616EA0305A8C53E9184B5314D75A0C87A37B30D0058483BD95919840C7033447E23755FDD36594332327F63CBB3E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZV......V..[|G.>5JW.L..V..[|G.>5JW.L..V...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............F..{.....{u..e....N...^...............'..a/EAM....Z.[.........f........................................I.qk..B.....LZ.............F..{.....{u..e.........F..{.....{u..e.........V......V......V..........................................V.j....V.T.]..V......V..B..V.H....V...B..V...>.)V...J...................;........4...4...4.."..............V..V..V...z...y.. x.. ...........$........4......7...7........................;........4...4...4.........V......V.....#V.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000015.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.148580222466502
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:1sfV4WL39x5pE15XI9yAT/RKef7emt5zGv:1sfV4m39qbXI9yALRKefamt5z
                                                                                                                                                              MD5:D78B59CD7276655E755D2FFAEB3A2CC0
                                                                                                                                                              SHA1:81B7294C4CF780379E5F8FC7EA3395BD97BD5B79
                                                                                                                                                              SHA-256:CF47D5EDD4E8F4484964743BC5B94A1956E332316A940FEC440BA2ABF10A9589
                                                                                                                                                              SHA-512:94F3C93FED689AD8360639D8E974FEA0512CA0314662980467B3E51FEFA2772127F843EFD0CD0D0CB1BD7EEE903407A6CA0FCAF1CC3780B55D22D0A2B07128AD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.j.......j.e...%....W..j.e...%....W..j...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............#..f"4.2....^.....N...^...............'...oD.a.b.,..........f........................................I.qk..B.....LZ.............#..f"4.2....^..........#..f"4.2....^...........j.......j.......j...........................................j.j.....j.T.]...j.......j...B...j.H.....j...B...j...>.).j...J...................;........4...4...4.."...............j...j...j...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........j.......j.....#.j.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000016.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.116801980842352
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:bBs7+2qwNrONtYWEmCK5XuFX9DxToIxrdSr4I1ddXxJQIEp7N:bBstqw9oNEmHX091TxxRKjds
                                                                                                                                                              MD5:72BF1EC1633E94DA128E1B4973E4B5C8
                                                                                                                                                              SHA1:784B228C7A6AEFFE29DE0EAD9075A3248EF7D357
                                                                                                                                                              SHA-256:F1C7450D09016A6E689D84D926D97B631BF3B12464C903316E43A43EA1A55A5D
                                                                                                                                                              SHA-512:34E3CC3B36592F6D6513F49BE6F9EF5AE50A6DE479EC47A3DCA412188CB65609F9B7B4EDFAEA4292CBB22A3E431753E7F0481B715F5CEB6766295F89F1A34A4D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................Q.......Q... .6.-K.\...I.......I.qk..B.....LZ.Q... .6.-K.\...Q...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............n.V.i....6...|....N...^..................b(?/C...KA.Q........f........................................I.qk..B.....LZ..............n.V.i....6...|..........n.V.i....6...|..........Q.......Q.......Q...........................................Q.j.....Q.T.]...Q.......Q...B...Q.H.....Q...B...Q...>.).Q...J...................;........4...4...4.."...............Q...Q...Q...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........Q.......Q.....#.Q.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000017.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.144487319524614
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:KHudsHtNQ125cb747JteUElCC5nIX3I9KGJToBXrdSrCIMcudXe90QE1Xl6OPYTG:KHuds75c4FNElCTXY9pJT8XRKA95UK
                                                                                                                                                              MD5:B8836B48BB90751E0A5AF358360B2785
                                                                                                                                                              SHA1:523A328318742AB3C653DBAA3D7F6799B682C8CF
                                                                                                                                                              SHA-256:40FB174A477B207E1E1AA7851BF444A46451F5071ECD7525AD8E58D310BC5FA9
                                                                                                                                                              SHA-512:94AB46051483FA15083C47A95326EADCECCE70033A509EA39D2E1D1E907B5EB4A80EC133E3C7E3114C4AEE36A7A7ED885862119F218FCDF196BE5E06869DF153
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......,...v... ...................................................................................................................................2...>...........v...T............................I.......I.qk..B.....LZJ.......J....5..5.-Q.X..J....5..5.-Q.X..J....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............Rj.?..;..P%P......N...^..................^W.H....z..........f........................................I.qk..B.....LZ.............Rj.?..;..P%P...........Rj.?..;..P%P...........J.......J.......J...........................................J..j....J..T.]..J.......J....B..J..H....J....B..J....>.)J....J...................;........4...4...4.."..............J...J...J....z...y.. x.. ...........$........4......7...7........................;........4...4...4.........J.......J......#J..............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000018.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.104080172641677
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:K0bsBqN2hMLXC46xlO8qtC7sE6tiC+GxpXup9JurXFDToOrdSrXI7dXRnVz0QqhJ:K0bsPmXWxjqYsE6c74XY9JoTrRK02j
                                                                                                                                                              MD5:2AC60918AB7A43F752F88495DFAB9CBD
                                                                                                                                                              SHA1:72E1FC4E41E3D7C0C5928624E93072657A16A79E
                                                                                                                                                              SHA-256:0F871E37130865E39C430103CEA63506BDDA9466093E05F805F2156A70070C9C
                                                                                                                                                              SHA-512:0C4A4A77F8B09583A85160F63DD386695339A02EE3FB6808F82286F43CB3DDFFDA6C5D9EC49AE0B8B8712B2B54D4BE856AF0CDDE70240E71F684176B11CFE9D3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......,...v... ...................................................................................................................................2...>...........v...T............................I.......I.qk..B.....LZ..q.......q;.n....w...Jr..q;.n....w...Jr..q..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............%..2...*..w.-.e....N...^................@h.x.hB..b`..f.........f........................................I.qk..B.....LZ.............%..2...*..w.-.e.........%..2...*..w.-.e...........q.......q.......q...........................................qj......qT.]....q.......q..B....qH......q..B....q..>.)..q..J...................;........4...4...4.."................q...q...q..z...y.. x.. ...........$........4......7...7........................;........4...4...4...........q.......q....#..q............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000019.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.143585150551341
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:Q6dOs4ALmVQGGEP8IXHI9cY/A6DZTGRKN1oY:NdOs4ALmuCUIXHI9cBeKRKN1o
                                                                                                                                                              MD5:6D0C405E5C5B42C57D1400809A80AD26
                                                                                                                                                              SHA1:D46AC4D302C727E641C13A6301893C394D66ED0A
                                                                                                                                                              SHA-256:8A2A70D4CBDD773DE77FEA48626C09D7BB958EDDA4256737EC3D9DFF68FB442C
                                                                                                                                                              SHA-512:234D2B3A5B4EA08D2D24D7B2BA2F2F7CAA3BAFC8F62A5790453B5E4EF7AE6496EB6EB8B9504E1F5D7FCFFFCAA94D0D77E53C30B4ACD11B0358C4F8530AB2CF78
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>...........v..."...................................................................................................................................2...>...........v...V............................I.......I.qk..B.....LZY......Y.6~..+..aR1..Y.6~..+..aR1..Y...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............qg.7Q.C.=....Q.|....N...^...............f.f...e@.#..............f........................................I.qk..B.....LZ............qg.7Q.C.=....Q.|........qg.7Q.C.=....Q.|.........Y......Y......Y..........................................Y.j....Y.T.]..Y......Y..B..Y.H....Y...B..Y...>.)Y...J...................;........4...4...4.."..............Y..Y..Y...z...y.. x.. ...........$........4......7...7........................;........4...4...4.........Y......Y.....#Y.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001A.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.083392503387468
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:Js6jX5KYM34tkQSWEVC/lXY9TFiWjTo0rdSrSIySdXXmyKPoy3RT9:Jsb34BEVwXY9xJTtRKli
                                                                                                                                                              MD5:53E6B102115348BD3C0D3C31EB253756
                                                                                                                                                              SHA1:9D874A2CE758B125F62D6224EAEA05DC4D525348
                                                                                                                                                              SHA-256:5C5EDBF4BABFCA1ADF3E5911087098380C644A597946834616504A712C86AB1B
                                                                                                                                                              SHA-512:FA2EC71D257F9E6C6732CB4EC393A06B686CE9B08821EFFDFAF8C6460C943C730CB086292E164F41BF28AFE9BD980C81357B6ACBE01C4428AF8C29B70D83EE8A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ..Y.......Y;.......8.,...Y;.......8.,...Y..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............q.>J?8+.0.....L.....N...^...............*O.....J.k.}U(.8........f........................................I.qk..B.....LZ............q.>J?8+.0.....L.........q.>J?8+.0.....L............Y.......Y.......Y...........................................Yj......YT.]....Y.......Y..B....YH......Y..B....Y..>.)..Y..J...................;........4...4...4.."................Y...Y...Y..z...y.. x.. ...........$........4......7...7........................;........4...4...4...........Y.......Y....#..Y............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001B.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.132097407088457
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:5c6suhzlluDG6otYyEsWCjtwXo9s9PCmmToerdSrYEI0qdXpWUG0y:5c6sUS5ohEsWMiXo9yyTzRKKw
                                                                                                                                                              MD5:C93CD9F5A99CC2621F1F6C721983BE04
                                                                                                                                                              SHA1:82975378E49231B261DD6E4C30EB07B3F32B6D67
                                                                                                                                                              SHA-256:67672AEC3F749B7F948429C50D7549D26EB1FECD412CF7AC212F069D18A02B5A
                                                                                                                                                              SHA-512:7EEBC1C9ADCCAC115AE98047A87CBE2D9EB1A49FE45073A7A325703D70D4082D5B752B3B6C2A7624FECD298BE6C70571D18475DA8BFC4C30428BBCF6B93BE571
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.............<.|./.}.....<.|./.}.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'............./...T./..O?BV.....N...^..................z.D...0..U=........f........................................I.qk..B.....LZ............/...T./..O?BV........./...T./..O?BV.........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001C.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.119444585815578
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:Rsdwe2dVl+pNHER3c1IX3I9UvTORKA5ebg3hV:Rsdwe2dVl+nkxOIX3I9UvyRKA5ebg3h
                                                                                                                                                              MD5:AA921211B0675FC9929C8314155BEB21
                                                                                                                                                              SHA1:F21BFD89E8220ED1F34F5CC19CA2C4EFD1C9C7D2
                                                                                                                                                              SHA-256:F044034A05206F26DA54456CF76883DEC5143E39464DF6130677960EDB864074
                                                                                                                                                              SHA-512:3FCC66BC1EB8DC4346CAEB0636F0A0E3C8CD58EF8AEBDF55E6FC1CE7D75D6EEE5E7456F947FF5F40A8D0F3A180FD5B951800D649AD3AAFAA6F9182EFEDF8B369
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ)i8.....)i8_\...8-):....)i8_\...8-):....)i8..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............{.K........;.hnu....N...^...............Z..P...M..>.}:..........f........................................I.qk..B.....LZ............{.K........;.hnu........{.K........;.hnu.........)i8.....)i8.....)i8.........................................)i8j....)i8T.]..)i8.....)i8..B..)i8H....)i8..B..)i8..>.))i8..J...................;........4...4...4.."..............)i8.)i8.)i8..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........)i8.....)i8....#)i8............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001D.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.104576664380145
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:psk/wU9kJENA1s2DXc9VgDBTURKsGt1d:psQwU9VyDXc9VgDBIRKsGt1
                                                                                                                                                              MD5:B48EC71D36E1AA23D752D69F387593AE
                                                                                                                                                              SHA1:36C7EE6BDD3C4EC79D8243FD7E3D5E94EE5C05C5
                                                                                                                                                              SHA-256:02C3D0CCFC5E6E16A47EE0461E767963B5C27A0874C78792E26515E213A437D6
                                                                                                                                                              SHA-512:E5223FAB23BF5F09830912ACFB665F02194752A0C30A0F8532674CC4EDB2B5933D2B68AD6E215032B45292DEC9587E5FAFFA1F6C078087A3E337009B0254602A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.h.......h.2.[....M."c..h.2.[....M."c..h...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............|,...p.#..oya.....N...^...................s..K.0a../..........f........................................I.qk..B.....LZ.............|,...p.#..oya..........|,...p.#..oya...........h.......h.......h...........................................h.j.....h.T.]...h.......h...B...h.H.....h...B...h...>.).h...J...................;........4...4...4.."...............h...h...h...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........h.......h.....#.h.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001E.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.132491661256422
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:KEsGmIdYuUt+k3CzvIEyrCQGXA9vZM9eTo/rdSr5IEdX8l0QTDq/d:KEsyYuU0zwEyr2XA9xM0TGRKx9
                                                                                                                                                              MD5:E41A5D05DC703434210F6A5CE5AF6A7C
                                                                                                                                                              SHA1:26DB12747E65A257EFF303C526C2F153C8BB5CEA
                                                                                                                                                              SHA-256:DE4EFB2EE73F5048498641FB5E7E8C438B27D80C8862E3BD3A0F802A85C703F0
                                                                                                                                                              SHA-512:294092020169B96DF0528E85F7A02E96095D560353372C047685BD99940D7057F3CF9B2544338A09E2FD0AC6F4C108AE0E3CE4FC47F551D8F37B068E4C773144
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......,...v... ...................................................................................................................................2...>...........v...T............................I.......I.qk..B.....LZD.{.....D.{.H...4B..5.TD.{.H...4B..5.TD.{..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............J...<y...}.........N...^.................&I(yqF..P............f........................................I.qk..B.....LZ............J...<y...}.............J...<y...}..............D.{.....D.{.....D.{.........................................D.{j....D.{T.]..D.{.....D.{..B..D.{H....D.{..B..D.{..>.)D.{..J...................;........4...4...4.."..............D.{.D.{.D.{..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........D.{.....D.{....#D.{............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001F.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.123354192382561
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:masuNUr59qhpt/MEJlCDUXHe9HPQ5wTojrdSrljIwdX0YFmpeXMdf:Psh59qhpuEX1X+9vIwTiRK1bFNMd
                                                                                                                                                              MD5:CF97767760FDE0738A874F0FF6764E81
                                                                                                                                                              SHA1:E72710CE2A2F9E261E31E8D2663929F3648874B7
                                                                                                                                                              SHA-256:1DA406AF5CC5DE5D524549E103271F75D35F5ED532EFE8BCDA1C2A908C3C960E
                                                                                                                                                              SHA-512:C3D91BCCA4A4EEE55E2B371EAC4E3AA6B7E51A647A8C2E5BE04C0B5AD32DDA2A20B36DFFE28953DA35EBF07BE745E4776B6B48CDBFA0D39AFFF91460580D2C2E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......(...v.......................................................................................................................................2...>...........v...P............................I.......I.qk..B.....LZ............f...%3....A....f...%3....A.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............bg....U..)..Y.......N...^...............l...0.dA.jrn.IiC........f........................................I.qk..B.....LZ............bg....U..)..Y...........bg....U..)..Y...........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001G.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):3.560886524060614
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:NVu6Wc9LC/qF5tBAEG4IEdEPc4IwH4Iw0w:8c9Aq7dODPUwX
                                                                                                                                                              MD5:8F1B9508DA32CAB86EABB2A3393227EA
                                                                                                                                                              SHA1:3B174B389077B79F843F32B2CE6F9BFF4CD30B47
                                                                                                                                                              SHA-256:628FE39268B91F2E9CD80231C8ED64EFBE2D37F338314E9B758C735A6CE75A85
                                                                                                                                                              SHA-512:B1B1B4013C8E542C7C592DD624F7D51304FD76CF9B75BBBBB0F707D0E21BCF8EA50B25B30B6591371A62568CF20891865C9408E31A00CBC1A12D9CA52FF4C21F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:\...................................................................................................?...................................................\...................,...........................5.......5...W.......I...r.......r.~...C.4..."i...\..... &.".........Q..N..$.;BLa....Q.N/.n{&..(.k.*..EN/...........U.......U...................................................ms......ms.g..."f..{DC.U.......U...'.M.<R.h.#..2...........^.......0............r....C..b..ms......Z............r.T./....CT.v...bT......vT)...U.......U...."..U....n.....T)O.......b......Z...c..,0...e...B4.$...........GP..A..}.....J.....................r.~...C.4..."i.r.......xcG....E.......btS.fI.[.].y...b.....>...............N/.n{&..(.k.*..EU...'.M.<R.h.#...btS.fI.[.].y............0...........e....4.............."...P.r.o.j.e.c.t. .O.v.e.r.v.i.e.w.......B.^....F...r.QH.....(...........(..."...P.r.o.j.e.c.t. .O.v.e.r.v.i.e.w...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.r...P.a.g.e.V.e.r.C.o.m.m.e.n.t...P.a.g.e.O.v.e.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001H.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):20480
                                                                                                                                                              Entropy (8bit):4.624309702045867
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384://3RQ3y32Ivf5ei/aPmRtCLHBOuJ+7SVz+kQtxyz5z6NjNbmz4CwDmDSG://3eC32Ivf5ecaPmRQLHMA+2Vz+kQtxm
                                                                                                                                                              MD5:56869A26DAFF7C000DE7FF6ABD36BBC0
                                                                                                                                                              SHA1:D41546BA12E29D163BEE903E6167EDDD612C9FE4
                                                                                                                                                              SHA-256:4BBB4680A5FE6346F007B9C105581EF1B7C71B4C8DCAF983A7A3622A63C504E0
                                                                                                                                                              SHA-512:7DE7C5D1981670EB8260F06C5EDD6EB5F6857EB39166C57D14744D5B148640E10598944B498EF8513F3D9D5C619A53C454F1766B68334D05E098BB68454C6FC5
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....>...........v........@..( ..`J..........>...t...8...v........H..( ..PI..................................................................................>...........v........I..( ...I...............I.......I.qk..B.....LZ.........V....<0..x.G...V....<0..x.G^.....8.....$...M.....8..I.qk..B.....LZ.I............I.......I...................................................I.t.....I................................................................4..'...'..............".......B:;.x......N...^................0w.~.@.W....<F............J...............................4....I.qk..B.....LZ.............".......B:;.x..............................................................................................8(.6....8(.z....8 ......8$......8 ......8(.5....8 ......8$..........3..8....z...y.. x.. ...........$........!..7!..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.3..............Z4...........................................4../4......p...............C.a.l.i.b.r.i.....

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001I.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:06:24], progressive, precision 8, 38x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):22203
                                                                                                                                                              Entropy (8bit):6.977175130747846
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:5q3R1VBvq3R1Flrk6Q0QPJJrR39joOVMJ25d1NkMhIwobbtAAAqYnLJZMJYZ2AC:xw6Q0WJR3FoOVMJIIlAAAqYnMJdD
                                                                                                                                                              MD5:2D3128554F6286809B2C8E99DE5FD3F6
                                                                                                                                                              SHA1:FC42CB04151D36F448093BDEFE33031A9B8D797D
                                                                                                                                                              SHA-256:14FA2D16310485AA1CE41F6D774A3D637E8CF8B03C4F72990155DF274FDB6BD9
                                                                                                                                                              SHA-512:D8531247A6E89ECABEA9C4A78F596CCE3493334EDF71AE4F7998FDDD0F80705948609C89756AB56FDFAB6D04DEC5F699A693801A772CA2EE2465BDD2CE5D2D5A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....XExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:06:24............................&.........................................................(.....................&...........*.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...H.....Go.Kxn.b..g...........%?_....O......q......7G......%%.V..8zm.].v?...jJ~._..>.......O;........o..rI.A.....n.a.........

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001J.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):3.9727414031823813
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:fsqZmD63hcEsXF3mDR/cMxpkt9Un3fa+R:UqQ63hcEuF3cR/RpkvUn3iq
                                                                                                                                                              MD5:4A25EFE1FD99F4749C9B20D5553D7F28
                                                                                                                                                              SHA1:3CD920C5CA50EF3CD805A8EB0E6E951B699A7ECE
                                                                                                                                                              SHA-256:5220C52FE6BCC74A737347A964125780AC164EBD6D18349666E8AB9D77D4F1A7
                                                                                                                                                              SHA-512:85533E414D506D39364BCF6B53FE542A5F9700FC00FBFBF8A53512725F22DBE3098E290956B0B4E08411FD4FEAC38CBF99BF19012F8AC64399C8B839637E1DD4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>...........v.......................................................................................................................................2...>.......Z...v...&............................I.......I.qk..B.....LZ.)b.)....)b.W.....6..X..)b.W.....6..X..)b..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............J..?....0.bW.-:.....N...^...............Mp!....@...I.ou.................................................I.qk..B.....LZ............J..?....0.bW.-:.........J..?....0.bW.-:...........)b......)b......)b..........................................)bj.h...)bT)....)b......)b..L...)bH.]...)b......)b..H...)b..}.......Z4...........................................4../4......p...............C.a.l.i.b.r.i...................)b..)b..)b..z...y.. x.. ...........$........4...!..7!..7................)b:.)bF.)bG.)b..z...y.. x.. ...........$..

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001K.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):52945
                                                                                                                                                              Entropy (8bit):7.6490972666456765
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:cjvqR0XvFaGCTJffi0tgybmWDoTw71kHUAnjvawrlp2+NUO8dWSNl3PF2PjK/q09:cyRffflgybmWoTw1UUADHUbU21MjpAD
                                                                                                                                                              MD5:AD003F032F32FAC4672D4CE237FA5C5B
                                                                                                                                                              SHA1:AE234931B452F0D649D91291763B919CF350EA49
                                                                                                                                                              SHA-256:ADB1EBBE18D6CD8FF08AA9BF5C83CDB83BF9AA179698E34E93DBCDDE12F04D32
                                                                                                                                                              SHA-512:ECA25FA657ECE3A66D3E650628E0F65D3BADD38864C028AB6553950A1A66D7D55482C85E9E565573E9E5AAFA91C2D53235971C644A266D41EB69F8E72E3A843B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQ..aq....".....2....BR#r.b3$...C.Sc%...s5E......................!1.A..Q.aq"...2...#...B...Rb3..$..CSr...6............?......y_N.e.H7?........W..w....k|...S..d.4.>.RW5z.$.i.)V.O....>o...c..*&1.D..O..".ufbb..1...t..u=..K...m...~.....F..-.fb:i..=f..C.w.[{..~.7k....;..:..3....4.....$..m]...}....~q...9T.#..7.~..8...q.N;c..ffo.w...W..d........../t_........lWJE..).>..v;:=....Rrw#.m.n.n...E...vm.J}2N*..|.4...80.#..e....t.J..ZQ.x|g/....F..e....k+vK...M..W.X.e.L..~...j.....kz....=...n:O.:..[.L,.+R...Y..zKNI....,..{e..U.'...}.......|..t.]...~...b4......_.i..../.......m...a..n...v.j.?..Rc.$G|.31..#..$?.........h.w....-... .a.%z..u......u.A....Fm..J.......G..[...w.....:....w/.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001L.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12288
                                                                                                                                                              Entropy (8bit):3.505688377779702
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:cu6sEirgP1hdFFRD9VX9LRUk2+RtguT/IayDMJhoa1Xx4e9M9FRJ8bR2m:X3EVxFFRD9dFRUT+RttQayEd1Xx4OM9+
                                                                                                                                                              MD5:439C61F81934C6C775B934DF8BEC606F
                                                                                                                                                              SHA1:5F753E0E42B6C562E6EEC15C968957B9840AA15C
                                                                                                                                                              SHA-256:32840E5623BCA7C4282BAADE1564F4C9F4528B5450D9C7699310960EF567EB23
                                                                                                                                                              SHA-512:0FDE292764AA36E223D39102EA68C536075E07DE0BA66EB61C6813E3E8DD38BEAFB204DD2182711AAD4DCDBB4A8E6C1191138811E6FE608817EC37E19FE83667
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>...........v.......................................................................................................................................2...>.......@...v................................I.......I.qk..B.....LZ....9......n.....V'p..VJ...n.....V'p..VJ.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............|.a.y..0..P.Z......N...^..................j)..E.S.....M............................................r....I.qk..B.....LZ.............|.a.y..0..P.Z...........|.a.y..0..P.Z..........................................................................j.......T.H...............\.....H.........3.......O...............Z4...........................................4../4......p...............C.a.l.i.b.r.i...............................z...y.. x.. ...........$........4...!..7!..7..................:...F.....z...y.. x.. ...........$......

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001M.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):25622
                                                                                                                                                              Entropy (8bit):7.058784902089801
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:EhK81gTCyJ/Gf9Aw3t8w8EtdPeGDh6bEi1Ie1u4ZbvgwTwrSRh7ZKNpIGY:IjcRXwdJvtdGsUbEi1IeY8vgwTyC1+Y
                                                                                                                                                              MD5:F8CCFC24DEB1D991EBE085E1B2D7D9BF
                                                                                                                                                              SHA1:AF76C22A765434AEDA134924C517C84107F4FED5
                                                                                                                                                              SHA-256:7354001527AB554C44E7D6981B86DD933B7DC2E0D3DC8512AD3EECD843245C52
                                                                                                                                                              SHA-512:818BC3690B01B30BC571E4CF45EC8D1AFCAECBAB003532644381F1CF730A5B3486862D08F7579B2D3D89167AD7DF35028881245C9550B0DA23D1F81A720A9704
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!...1A.Qaq.........."2Rr.#.t6..B..3S$4..v.b..Cs.%5..8..cUV.(.DEe.&Ff...T.d.......................!.1A..Qaq...s4....2r..S"BR.3....b#C$.....c............?..D.."}:......&&...?3..W.q*.......]...m.Y.k1......K).J...uV.b.../.0.E.H..4..W_T.[t.V.w.9.x.qe.L..o.oL.....d.\.....6.|.o...}..H{Yn..E...6Y3.l.e..D.:,.n.%...t...m.........,+,..|..n.....6.*...f........6.../$../Vi..H...e.f.F.zn.).n.E..2sTn.i...Yb?6+H&...Bf..*....z.o.^7[..u.:o....t.s=.....(.s.....f.g....q9o.u1L.N...smzE..[>...+\O....j.<....j.c.W.............U..+.F/.'..W...T./W...>i01./....j.s."..Q...{...a._~OW...Rp.)*.e..W..Q4)<..'..W...q...'..U..z..g......U}...O....w....0F:.N..V.3W.|..'z0.]...j..U[v..g$D.Lc[.e...UW.m0+

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001N.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):20480
                                                                                                                                                              Entropy (8bit):3.2140646305058858
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:yJsBDFYeOqAEe9LasyVYRRSWGOCL1/0GKW3X:yJsBDFYsAEe9LzyKRRNGOS1/0GKW3X
                                                                                                                                                              MD5:37F5A1C733FA678FB1DD3D87F5232A12
                                                                                                                                                              SHA1:9424BAFF944D5A181DE005EA508EB708BBBDC014
                                                                                                                                                              SHA-256:C80E2DEBDC61010693D89F2254DA86A9DA91F5445FA1E923B99100E28AFDD343
                                                                                                                                                              SHA-512:9C6C0818730E63B6579310D5FC05267A16D772287B998BA477AA6CF6515932F110AACD4CF53475C76D31E7DCB28C14AEBEF753232A8613A12080B73C3039BBE4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>...........v.......0 .../........;.X..)...............;.X..)..........I.qk..B.....LZ................................2...>.......B...v........-..............v........-..8....................I.......I.qk..B.....LZ....T......6..3.9F.6.K....6..3.9F.6.K......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............;.X..).........N...^................{B..5.A....y~q...........................;.X..)..............{B..5.A....y~q...............;.X..).....................................................................................................j.e.....T.........................a..................... .H.......z.......R...................!..7......}.....W.i.n.g.d.i.n.g.s. .3.......................Z4...........................................4../4......p...............C.a.l.i.b.r.i.......................z... ..$..............

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001O.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):15740
                                                                                                                                                              Entropy (8bit):6.0674556182683945
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:Elv3GG8/OOs+GouFdxMlxjoPyerzkpuOo2vPMc62PaJseZC+BJoS/:EtNiwdxMlZoPhzkpuOo2PMc6rX8+B6+
                                                                                                                                                              MD5:FFA5EC40DC9A0FD10EB9E6355142D6A6
                                                                                                                                                              SHA1:3D3D6A7E086B3C610C08F1F3E3F883604F06F2A4
                                                                                                                                                              SHA-256:D74C3973C8D1F7C77274691AFB1AA934940674341D7EEE563BE75E563281BDFD
                                                                                                                                                              SHA-512:6FAF2A24D06E6008F3579C7CEC90C2887462BDF83FAD7372FBB74B8DE90340B580E9836F309B68A9794597A598F7DCDA661C9A58DA6D8187C69083B7A17C9CD9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!.1.....AQ..aq.g..8...."r....2.FG..#.E..7.Rb..Cc..D.v.B..3s..$d.%5Uu..&6fW'w........................!....1Aa...d..5e.6.q...Q..."2b.c..r3DE..BRs4U.#C.S.T............?...u.&0...cV.T.I...1..=4....Ce_.g.q.=F.M:>)...k..pm..h..=........S....)Ja8x...b.).=5.q..0......k.M.....1?-.G.b&.5..Ep.8t...'...R)..ta.F$bXO]tW.b.6#.t.XWN..ZW......].....G....x&&f..'L.....7...\...'.8...~`.sa...............................................X........qo...SMk...'.V...i..hb.}&?/.k.:>l.^....>Y...<}...&.jY.Gn.MKejyV......D......gf.0....t.nw..XQ...H.B.....=8.UkR.....Hm..w..]...k...#Z...F../.gjWvf.....w.aZ].2..5..^...VZv..._.7..a.|...:.B...,f...............~....m.;_.....-.e.y.w.[m.].bu.b.f+.E++\.....Y..7

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001P.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12288
                                                                                                                                                              Entropy (8bit):3.7802903913498414
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:RsitRqBf0r2R1UyaQcKX4qffPPRtIFyb32LLdILaRv7W4XJNN9BIMV8hgx2DTIT:m2E0r2OQF4qPPRtcyiLj/XJNPBIMV8hn
                                                                                                                                                              MD5:3DAF7E3C131F29A5A3166851AC04FB8F
                                                                                                                                                              SHA1:BABB339BAD6717F472064C474AC7BD2C5B0D4F2F
                                                                                                                                                              SHA-256:975A0BDC8464BF5FBBD272CDA66F57D894752EB688E054A7BCCA1AD4E418D340
                                                                                                                                                              SHA-512:15136AA9310BFC334085F0A1283E32B2DCA366890367513BBBB5F07C8C539BC4528DEB6CD59EFE21166FEDE7B81DA35CF76653B20A6DDE7A748551305FA91F12
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>...x.......v........ ..`!..2...>...........v.......@................................................................................................................................................I.......I.qk..B.....LZ8...9...8..+.....0M.*.-.8..+.....0M.*.-.8....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............1p%.....6_.".......N...^...............q...> D.,..]...................................................I.qk..B.....LZ............1p%.....6_."....................................8.......8.......8...........................................8..j....8..T.Q..8.......8...n..8..H....8....9..8....V..8............Z4...........................................4../4......p...............C.a.l.i.b.r.i..................8...8...8....z...y.. x.. ...........$........4...!..7!..7..............'8..%8..8....z...,4. ...........$>........4

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001Q.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):55804
                                                                                                                                                              Entropy (8bit):7.433623355028275
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:gVvci05lhVbfBcWvBLeynluexaWqzww/u5:gVUZhHDljaHww/u5
                                                                                                                                                              MD5:4126992F65FE53D3E3E78F6B27FD49DC
                                                                                                                                                              SHA1:BC0D76B69310DA9B909D3EE4CECBFE5F386BFB45
                                                                                                                                                              SHA-256:3FBE3C1C238BD7DBC67F8CFF5F3BDDFD513C96A9851B9616477947D21DFF4B2E
                                                                                                                                                              SHA-512:624853F5E56D224C8188F122B2C4724F867D4099E7FAAFB9C945BE7E2907900ADCF4AE97AB08909CF94E96FB6F381E3B6396D560D93EB2731E4E69CBFE628F10
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d..............................................................................................!1...AQ.aq"2.....BR..8x..r#..9b....3....CS$.'.cs.......7Gw.(.4%5&..Wg.h......tEVfv..H..........................!1A..Qa.q...."2..u6....BRr.#...b..3s..d...7.Cc.$Tt..S4.5Ue..&..%.................?...,...8..{..S.y.N....%..q.8..H[5....o..xg........)c(.eO.YO..._D..x.U.....%.S.r.r._.^..Su.h.Q.t.:.#?....x..B.S...Q.....oqF..%..8'.qx....%.2JKjF..{y.w0.*a.RMb.c.Q{%....eW'..[IV..'ZW3...[...MN.....rO.:....$.i..7....Vrrr...I.r..M..Qo..j....q.^...N...J......%.J..)F...>$.....u........o...+......[...*..t....R}.I..R..S..GB..:......).6_[^Xft...F.1.....zP....,.#....MG.T..Q.F.....)Fi../.I...,%.voEb.b.Z..V3..FT.}..[Z{....wd.z.e.....QwW(.).t..\..'....:)<W.<..&k...caRT.X(..K.....:f...]...q..

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001R.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12288
                                                                                                                                                              Entropy (8bit):4.630567613318926
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:4sxSHbEhRKR1Il5ePQFoNfwqo681JiehKHftsWXXViUtFdaRtAzosmF4K6bUY9yB:txS7cRKbIv5uwqo6scUKfiIURtRsK4KZ
                                                                                                                                                              MD5:C36B3316B785D2F7EC7AFAFC0CCD7B3C
                                                                                                                                                              SHA1:CEB5CE81E7A2CF06F421692B54C781468A4108CA
                                                                                                                                                              SHA-256:920B2921092888FD6B76880F32222BF1B229995FC3BD5048613C94B89F60BAB3
                                                                                                                                                              SHA-512:6C8E0F5F86574835FFC16ECC187F610BD9485D8ACA174B75D013269EBF7BDB82F1E25FD6F3301997B0DBC35B4FC2ADF56A9866B823C89CDFA60BFAD88B3340E0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....>.......>...v.......0 ..h+......>...........v...Z...@...X*...........................................................................................................................................I.......I.qk..B.....LZ1.......1...ECd.;.p.u...1...ECd.;.p.u..g1....I.qk..B.....LZ.I.....]..nD.(&d..v..............I.......I...................................................I.t.....I................................................................4..'...'.............*rn...dF....|............................G?P|.pI...)........N...^........................................I.qk..B.....LZ.............G?P|.pI...).....................................1.......1.......1................................................|.....(.......(.z..1..j.N..1..T)...1.......1....b..1.. .......'1..81....z...,4. ...."......$>........4.."..7......A.g.e.n.d.a.:.........................Z4...........................................4../4......p...............C.a.l.i.b.r.i..................1...1...1....z...y.. x.. ..

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001S.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41893
                                                                                                                                                              Entropy (8bit):7.52654558351485
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:pZvVQkUbOHxx3pvVmO5rsP5gUdXwFMuv53knzyncaXgRDqPU:pZkijV5wScXwFMYknzucaXgRyU
                                                                                                                                                              MD5:F25427EFECFEE786D5A9F630726DD140
                                                                                                                                                              SHA1:BC612A86FF985AB569ED1A1EA5FFC4FDB18FC605
                                                                                                                                                              SHA-256:5A36960DF32817E8426BD40A88F88B04FB55B84BAEF60F1E71E0872217FDB134
                                                                                                                                                              SHA-512:B102F34385196D630F198667E874F25ADBC737426FDAE0747EC799B33632E5DC92999C7C715DC84D904342738930267AB1709870BDAA842243E4C283FE5E1554
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................!.1AQ....aq......"......2...Xx..9BRr#.b3$..&..g.8....%F'G.(H.Ss..D5E..v..W..Cc.deu..7w.h.).....................!.1....A..Qaq...Ttu.6..."R..5...2B..S....bcs.Dd%&r3C...#$...Ue.............?..R...%.R...t.MQ*.l...v...V]..n...Zw....M....4..F.&&bb0.:]l......ay.r<..3.l.Q^.........I54.N2.8..2s...w..r6.......[1Zh....O...9..>...B......x]...r.\.\..v..~....y.QT.3.......=....r..}.l.....o;....M..C1....w)...+o1f.]...MoA.E..s5..i.\....miGsy..m\.Zj....I'YU.\tU6La5v.>.K..m.]1.......k..0....</5v.V7lY.e.vV.+./[....f..u{....s.}.Rb.Z.....Y.6]..m....V.\...Mr.=r...K...l..%..m^.......X.(..fG..[F*ly.jL.a4..vs..o.e..q.9km..w1.yg.....r_.*h.n..5i.-.{Y.l...<...'Or.s..Z....../JP.....\FV.S..............m

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001T.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12288
                                                                                                                                                              Entropy (8bit):4.576427515898853
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:/sYCDi2PX5F9Lg/eTLQdU5k+1Oomr+ZifH2bQX/UO/sOjRtAyGx/ep8kA9zBW:0E2PX5Hc/eXGU5lclr+ZiP2WzHRtcx/m
                                                                                                                                                              MD5:4DE915AAD2ABDAC2A5AE492C3532B4DE
                                                                                                                                                              SHA1:9247AB76C14EAD552CD904714DF8280A2422F4F8
                                                                                                                                                              SHA-256:6771448960001EF1EEF8F665FDAD7EDB5C7236D4154C0DB95C6500EE302CA287
                                                                                                                                                              SHA-512:8102A1A0108EEAA9B89920EAEB413B3250C56C491E5FED720738B16D1555BDE40087E15CC1BC8DD0203610AC1405164ECDE7D5411A76D5FE7FC99331E1D6CE89
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......,...v....... .. +..2...>.......|...v...H...@....*...........................................................................................................................................h..G....h..+......Cu.i_.I.......I.qk..B.....LZ.h..+......Cu.i_.h...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................6-...X./U......N...^.................<.m.sA.l.rZt..........V...x....................................I.qk..B.....LZ.................6-...X./U....................................h.......h.......h...........................................h.j.A...h.T.....h.......h...r...h.......h. .7...h.......h. .........Z4...........................................4../4......p...............C.a.l.i.b.r.i...................h...h...h...z...y.. x.. ...........$........4...!..7!..7................h.;.h...h...z...y.. x.. ...........$......

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001U.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):14177
                                                                                                                                                              Entropy (8bit):5.705782002886174
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:EbgGcV/hlvpfal7rgYa8S7auAxwfuSTmCSNoFQ6NO7L:EbgGcVnpwimnd38FdQL
                                                                                                                                                              MD5:7CDCE7EEBF795998DA6CAC11D363291C
                                                                                                                                                              SHA1:183B4CC25B50A80D3EC7CCE4BF445BCFBAA6F224
                                                                                                                                                              SHA-256:DE35AF949D4F83E97EE22F817AFE2531CC4B59FF9EE6026DCA7ECEBC5CF2737F
                                                                                                                                                              SHA-512:560FB15A9C12758D11BB40B742A6EAD755F15AD10D6C5DEBA67F7BC8A2AE67C860831914CBCBCDED9E6B2D1D5F26A636B9BCEF178151F70B4D027316F94F27E1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!.1..A....Qa".q..2.....&...B%6.'..R#3.$E.r457bS.DUFV.Wg(.......................1...3.Q..2Rr....s.4.!Aq.S.aC5B$%............?...n.Liq.}.{#....3/gg.1.M +..~3...q..+=..:.g.i1;P)7.....q..n.s"p...wx........v.t.f;..L/..~....y.r[.r.....n.n3..6i..g..}../........3..x.L.i?We..l.......~..<.;..6..o.....N.t.o6.l..~.......<...m.V...Q.7k.u./wq.t..;.I...}..{...>.L..3m..a....yd......6~.f..~Y..}+..<.[w..'-..?.v.7...v.u..4.......1];..u.MO.......s..p..ms.'.O-o...O......m.k.e....)t....i>..E|....,iOyD|.{......g.n...cu....=..........h.\.Q:?g/?.I.3._...t...d.n.0.%y....S.Q....S.&K.w..&wY<....%.g.v.....$y..#,i;.=...t...I6..yO..o.d..w\k...~......)..rK.......].u....N....e.s..kU.u..'}

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001V.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):49152
                                                                                                                                                              Entropy (8bit):4.643519902251599
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:1K7d8g3+XN0cN4uVsMwjkWZ/Hfud2MLSB02P18JK4vb91gQE8DXMRQmgshAQoxR9:1k9aNVWlXIBk5SnlKt3taXk6
                                                                                                                                                              MD5:8FD21D2416B4EB856E236D5E95E04712
                                                                                                                                                              SHA1:1933841DA1DD4EBABF1ECE08DBC0DA7AEEF24F48
                                                                                                                                                              SHA-256:84F0F013F75079E5FC9D103136D900F2A2E91D85FEB0A9939AE40E55E828023B
                                                                                                                                                              SHA-512:EBC073C1A3D71C9C4F8D886E15B48DF01B81233C43BD4248C68B1AFEE78B1B5EA252165ABC6A9B54C6F380AF5FE26D264EA0D4AE942C06EB24B01B6C6DFF963A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:v........&.......%..F&....... ..X@..@`..8.......v........%.......%..b&..x.... ..X@..@`..................................................................v........%.......%.......... ..X@..@`..X.......1.......1......K..v.z.B.............,LB......$...Y%)...^..._..........8.!\.....e.....y.........1W...y...........zAz.....zAz.................................................1..T.......T"...f..T%....{.T./.....T.....n3T.....<6T%...3.>T.B...........0...........e....4........................u.^s.Q.@.).~b.......(...@kO.....(..."...P.l.a.i.n. .a.n.d. .S.i.m.p.l.e...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.r...P.a.g.e.V.e.r.C.o.m.m.e.n.t...P.a.g.e.O.v.e.r.i.d.e...P.a.g.e.N.a.m.e...2...0.0.0.5.2...1.....0...U.n.t.i.t.l.e.d. .p.a.g.e..........n3......n3..;.L.........<6......<6...O......iv2.......N...........L.......2......._...f...dj..........D............Nr........1..c..,0...e...B4.$........{p.....G...^...?@kO...................O.{.....O.{L. vD..8.....Nr......Nr...d.G.~.)zh..e........x=1...Re...L...

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000020.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.3626413765302425
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:YspFNSeiiiE88mWXWW9dhCRAiZ0LZCKuhLZObE:YspSHe8sXb9LCRAW0FCKqFME
                                                                                                                                                              MD5:68E8C82AFA17A2F6476BCDCABCEC3864
                                                                                                                                                              SHA1:FFC306E0EC1E0982BE831DD83CF54FEE55030FF5
                                                                                                                                                              SHA-256:F22CE5838402527F0E05E106E7533782BFD5D99047C11C71ED40CAA85A69987D
                                                                                                                                                              SHA-512:5C126436857F5D4BC9CDA551D82CB95B8A4B60F0644D01A5E6BDF09B114E071DDD99830C0957DD2A9B08F9E1B4E0ED5BCE421BC0664DD6BF3A7FEFD2EA4FC9FE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZf#......f#....1..4...f#....1..4...f#...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............l.).o...;.....$....N...^...............V|4.W.wA.._.p..`........f........................................I.qk..B.....LZ............l.).o...;.....$........l.).o...;.....$.........f#......f#......f#..........................................f#.j....f#.T.]..f#......f#...B..f#.H....f#...B..f#...>.)f#...J...................;........4...4...4.."..............f#..f#..f#...z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4.........f#......f#.....#f#.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000021.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 814x105, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12654
                                                                                                                                                              Entropy (8bit):7.745439197485533
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:JheN2cq6MLu6MLGu54cHeNzhcmhcDu53eNE3UPkhrxvu:Ji2Wix7fzVsbE3Zm
                                                                                                                                                              MD5:4BCCCDBB4273ECEBE216C84930A8D0B2
                                                                                                                                                              SHA1:FFBF617787E27BC94D9BAF89F2FE34A2BD42794B
                                                                                                                                                              SHA-256:474F9A8C25D5E21192315397EA995B1E11E2C1608157C6E0277688091BFD136A
                                                                                                                                                              SHA-512:DAD73A8C0E293B88685C0C71EF15E0DC95EE39B7FC9F849DE5D634173FD9FA0AF0AA96742D9E94BE03556AA4A817D5001C95A6736EAD5D5DF03661876785EB74
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....C....................................................................C.......................................................................i..............................................E.....................U....V...f..ASTc.......de.1Qq...!Rb....Ca."r.................................B....................b....Ra.....!Qc.....AS.1U.."C...2Bq...$#3%&.............?......3.....~......:..g..s"......:..g..s"..ic..Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. ..0...Q_..X..V5E~..c..X...@u...cTW...0...Q_..;.m.....@w...Q.+....*.4W...lUFh....v..._..wn...dW....y._..v..E~...*...@wn...dW....y._...v..U..@wn...d..{`;.|U.2g...*.3...:.0?ViN.z.@w...4.M.:m..`~..i7...q...I....J.`l...W..n..PQTiB...6....+..sj.*."...6....+..WA...x..A........(.N6`..AD.q.....'S...t.Q:.l.......f.]..N..0.. .u8..A........_W..Y...}.C...~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~.v..?U..^.r..}..Bep

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000022.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.350014074305796
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:HwskJoRh6Wat4/aEp8fXMJ9VNcUsrdhSrHAttXuc9Idlm/V:HwstIDXEpSXA9VNIRAsIdls
                                                                                                                                                              MD5:EE2D48F5E19ED39E1D228C317E7A03AD
                                                                                                                                                              SHA1:14B14AAE91A5DB93630CC425A1D884D415FCE1D6
                                                                                                                                                              SHA-256:64930F62419DA1C7813E5C3CED985898D0B7ABAD5630CD969243077FD115E33C
                                                                                                                                                              SHA-512:8ECDD81A03444BEC29C63E74D898171315FAFFBE18489CD73D37577238B1389DCFA0C9B7F65138342C37541501437554593F86207E0925664FC7B9F017BE9100
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.<.......<.+.T../...#f..<.+.T../...#f..<...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............S....&......RRW....N...^......................A. lc-vt.........f........................................I.qk..B.....LZ............S....&......RRW........S....&......RRW..........<.......<.......<...........................................<.j.....<.T.]...<.......<...B...<.H.....<...B...<...>.).<...J...................;........4...4...4.."...............<...<...<...z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4..........<.......<.....#.<.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000023.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 728x77, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2695
                                                                                                                                                              Entropy (8bit):7.434963358385164
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:N9YMsguOZgKAz2vcaQU4R8r4BU0/Rc4nbIQdsohw13ZmFLY6KsVvMdBL2mr:/hsEgNz2v5T/rQC67SoWniHK4EdBH
                                                                                                                                                              MD5:B23DE98D5B4AFC269ED7EBFDDECE9716
                                                                                                                                                              SHA1:10AF507A8079293A9AE0E3B96CF63A949B4588AA
                                                                                                                                                              SHA-256:646586CB71742A2369A529876B41AF6A472C35CC508D1AE5D8395D55784814F2
                                                                                                                                                              SHA-512:BBACBE205EC0A4F4E3AB7E2B1DEE36FCF087DDF77C7D18B53AEA4B15984A47C64E19F9B8D8FA568620619CEA0361D94FE7ABEA6E502EC6ECAEFE957F42ED7EE8
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......M....".......................................,.......................1....!ABQRq.2a."CbS.......................................................Qa1A............?....{............i........l..-D.q.~..|cS.S...R\..d.8,!.....]f$....Q..di.;~5......vj......MqCe..=.*.f^..=.}.Cm]qCd..s=..u.e..v..t'.,.....S.s..N...>.d4'.,..k...N...d..9....G...y....6J.Y.l.{Vf...^B..i.3.z....:5W#4@.S\fj.%..Mb.5.v.5......S.E..#.v.I.....I......m..H....D..|.Y|...W.Wf..o..U.0.E..@.T.....................................'.S../...Z......!J..1K..rI...T.f.>.+.N..o.....\..^u........e..q.qK.GXP..-...F8".;5J...]Y......j.a.,R.......J.N........z}<qu..J.)`.}X:..}.............B...[. ......,B.).b.......(Y.O....c\.o.e&.W.#Bo..N|..N8.#J.>1D.1..b.&....q.#..UT%,.d.....m&..^...VXA..b.nbTV~.....^........q..#./.I..=Q..=..Y.*.Ib...VZ+......Y.........'.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000024.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.360151236261483
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:JKBsktgbU6Bt/Dx6huE/E6Z0Xkc6+D09B9crlrdhSrzcJFl0tXmTw/9TkkF:MspQM9xzE/viXtpY9B9alRAYJFitSk
                                                                                                                                                              MD5:270F88AE8411654CA6DC4E8F2ED43CE5
                                                                                                                                                              SHA1:9D8D6CF746F55E9968EB296FE2C7233B01955CD7
                                                                                                                                                              SHA-256:9AE4683813AE2B07245A6E3D129A4632D56217050A8A2CA1147D1D8816B960D6
                                                                                                                                                              SHA-512:83148D70BB24F77E74005A5C566F0C7EDC6EAB99354FE86F91347C22D4D4D0C7563E2D7F861331CEDAB8F4B73CF7C9FC2DA4C0F6CD32418CBEA5F73CA5C4F38F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ..5.......5l...=.@. /88..5l...=.@. /88..5..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................ou......5X....N...^..................G...J.g...L3h........f........................................I.qk..B.....LZ...............ou......5X...........ou......5X...........5.......5.......5...........................................5j......5T.]....5.......5..B....5H......5..B....5..>.)..5..J...................;........4...4...4.."................5...5...5..z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4...........5.......5....#..5............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000025.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 69x630, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):11040
                                                                                                                                                              Entropy (8bit):7.929583162638891
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:u99+91V42ho91V42ho91V42ho91V4235z9pUkDCyixxo4PS6b8tEy3BcWWhhSy0b:ubKD4/D4/D4/D4uzX38u4PNYJ2zhhmb
                                                                                                                                                              MD5:02775A1E41CF53AC771D820003903913
                                                                                                                                                              SHA1:2951A94A05ECF65E86D44C3C663B9B44BAD2BC9D
                                                                                                                                                              SHA-256:83245F217DEAE4A4143B565E13C045DBB32A9063E8C6B2E43BB15CD76C5F9219
                                                                                                                                                              SHA-512:5A1FCC24BDD5EE16BC2C9BACF45BCECF35ED895EAC22D2C4EE99C1B7E79C8E8B9E5186E3D026BA08FF70E08113F0A88FBF5E61C57AF4F3EA9BA80CE9F33410E9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....C....................................................................C.......................................................................v.E.............................................S..........................Aa..!12Qqw.....3568rv........".....4Btu.....#Rs.(W..bg.................................D.....................1..2.!4Aqrs....Qa......t..."3BRb....#.$S.Cc..............?...K/h._+.N6.-.a...5...;.r....,...0B.s(..zp..4.%r|q..E.Q^.../...C.R..?u.q8XN.>.e..:..gJ...._.n>.70G,..(........3b.&.5m...Q../...7Ie..k....e.l6..&..`Gt.P.Y^r...=..Y.e...N.B...O.#..J+........u.V;G.'.....V.]8..C.]..........E.....c..w&lX..f..\T.J?...F.,..m|..93........,.....+.R..WG...%.....(@.....p].iEz<.8.^...J.h.....a8P.1......(z..y~.........H.Z^.>..<.....L.k..IG...R.(.%..m....&u...B|.....@]ey.W.J...!d..R.8...[..>8....(.G......!.)X.....,'..F2.Z.t..Aw./..Z..#..i.kK.......b.i...qR.(....RE.............O.XP.#..(...9J..]...,.2.[w....KrW'...tY.......{~.:.+..

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000026.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.473223892777621
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:KsWwVzZ0YYi1SK1tUEP3F7DXO9FA5rcbrdHrjOtX9Cz5+4ZSn4eazep6zyNn:KsAioK1WEP3FHXO9F0rKRLK+tk6eQO
                                                                                                                                                              MD5:2B3811BF72E22C5144B13646EE9A8104
                                                                                                                                                              SHA1:E2A89BE48FE03C5F7690D893AECAFFBB33C07311
                                                                                                                                                              SHA-256:922B1089E4F771200C364E0132D5BFBBE7FA9C17592E40EF42459FC54600E429
                                                                                                                                                              SHA-512:9959CEB14B2FAC9B0739D720044F21E89A9FDF25A36EE2BD28ED58E3F1FC434CE6C5E7C498B94E51CC351E3CE184D8015708ED8237AFB3A3D18CC2DD7C9BDA1D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......p...v...d.....................................................?....?........................................................................2...>...L.......v................................I.......I.qk..B.....LZ.]p......]p..p..7. .....]p..p..7. .....]p..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............*.*N......A.....N...^................j..G.E.9+.1!>.........Z................................... ....I.qk..B.....LZ..............*.*N......A...........*.*N......A...........]p......]p......]p..........................................]pj.....]pT%c...]p......]p..G...]p..H...]p..>...]p......]p .3...................;........4...4...4.."...............]p..]p..]p..z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4..........]p......]p....#.]p............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000027.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 105x441, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2268
                                                                                                                                                              Entropy (8bit):7.384274251000273
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:N9YMn9H5gXlM26vroVXWxyNnl1LmLR+rn4FOeewGhDbby:/h9SlMdgm09ll8R2/rby
                                                                                                                                                              MD5:09A7AE94AA8E517298A9618A13D6E0E2
                                                                                                                                                              SHA1:FA5181A7414BA32F816BF0C4278EC20C615E8B1A
                                                                                                                                                              SHA-256:3C68C7EE798E62A4A99C740153F3980D7DF029605C843410942C7F85E794823B
                                                                                                                                                              SHA-512:074E9A2BE2039D0AFEAD360157550B934FABD0CB86B5AF476C1FBC885EE60331F5A68EAF70BF76E23C8248A20FB900346839F4AA8892370B5889E64948DCC6E2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........i..".......................................3......................!.A..1Q."q.2BRa.b...#$................................... .......................!12AqQ.............?..D.z.4....;.....7...3.t<!..d.O.....+O+.;.z6.4cz7E.........U.Z)-..@..y...........}(W...<.xv/...5.ew......yN....n.Tk.Tm.Ty.vA=...T..U....h...e.8.5%....'......e^......L.g.$.~e..O.._...... .F`.....xnL.<.......]jfv...}..\G..c.......-%...#.C.|.].`..^..W..c..B..5D.QSTaZ.5A=....BU..z%.4.h.6..=..U...W.$..l...7.:...........IPQT_...~..i..x....~.l.|.n.J..TV.21.Tg.....................j.z!+.-............"j.j...)*..TT...."....T.Tc.**j..............j.z!*.h...&.&.&..e.%..TksTW%G.?".l+$..c._9..[x...TU..........i~X..#'.qm?ttO.....}*.i...q.....9..r..?..W..d.w...f;..q...tZh..0.....2.......OD%Q-.......$......56.K.O...y._..*_C.k..p9.p..O..vu...'........0v

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000028.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 76x97, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):784
                                                                                                                                                              Entropy (8bit):6.962539208465222
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:869YM8fij0W/xfuCp7ovv1bidiMn3bGi6AETQcdH8SADjoZgV6v9jUEvS3/g:N9YMWeI424diMn3yinsQeHvADu9QEvJ
                                                                                                                                                              MD5:14105A831FE32590E52C2E2E41879624
                                                                                                                                                              SHA1:078FA63FC7DB5830E9059DF02D56882240429D90
                                                                                                                                                              SHA-256:D0A3A1C3CD63C4023FE5716CBE2C211307D0E277E444D9EF76C7FC097A845FD4
                                                                                                                                                              SHA-512:8FC0ED24E8EC14C46EA523D9265DE28F85C5FC57AA54AD5B9CA162E95F79221E2AD3DD67D1293CF756B67F3D3DECAE122254134EA8D4D00DDED02114B5383947
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......a.L..".......................................-........................!A."1.Qbq....2Ba.........................................................1............?.....3.Ty\......vs....>.>..a.W..s89.d...Z}......rz...`...Z.r.do....u.W.%....gf.>.L..xz....B8=w...g.~g."HD...$..IKJ......nn..*ly..I....L...\q...Q;6.KrxZ.,...j$..ZQ..)f...q`.*..C1..cZ2]-..\.~..J.....^..(.f..9m?..C.NI.UL..X.fy.Z.........+n....r."Z...d..R./\.#...kd.D.5.!...h.3*s-+.......Xjt..}i..rK..y.../>u..]N.....Y..J......1.x./.....F6.......I...._3...k.sM.+..v;.%|.f.~.......:y....S....UKovh...W'........lF... .................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000029.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):2.7303731014796346
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:FshnaRo0SZBbkFbvMBNyTtUEwsUqXQq9J4d2NP7rdQVr5w0tXebLtNh:FsFeDSZVkBvRWExzXH9+d2V7RQ5tWj
                                                                                                                                                              MD5:7F1CF47D0AE69956C96138391C0B770F
                                                                                                                                                              SHA1:90B6261F050B44FE5E9891638D796C38C0672241
                                                                                                                                                              SHA-256:177F420C8584F7F22CF8A1F80B48D4C0A93AF64A467D67EC6CD70C77EF116AAE
                                                                                                                                                              SHA-512:D46722A4FEEBD29EE325845BF95C66C4DD234CB58E062E0A7E805CEB66CAAD3444439396CA389E5D251609306C7FC77E17CDBA6E33D3C83AAC2DDC7A8EB7FDD0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>...........v.......................................................................................................................................2...>...........v................................I.......I.qk..B.....LZ.d.......d...N....o.q-6..d...N....o.q-6..d...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............8...'=#..@..:E.....N...^..............._.9...C..'..G.a............................................^....I.qk..B.....LZ............8...'=#..@..:E.........8...'=#..@..:E...........d.......d.......d...........................................d.j.....d.T.l...d.......d...Q...d...Q...d...>...d.......d. .3...................;........4...4...4.."...............d...d...d...z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4..........d.......d.....#.d.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002A.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 95x498, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3009
                                                                                                                                                              Entropy (8bit):7.493528353751471
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:aRCTf+0hagMrbAZMJShPdvF/5OzlQFlDF7npkDdWvVBTEnBLT6NrgCX0:D+0YgMrApL553JtEdEVcL2NcX
                                                                                                                                                              MD5:D9BD80D40B458EDB2A318F639561579A
                                                                                                                                                              SHA1:83BA01519F3C7C1525C2EA4C2D9B40F28B2F2E5E
                                                                                                                                                              SHA-256:509A6945FACFB3DDC7BE6EE8B82797AD0C72DB5755486EE878125A959CC09B59
                                                                                                                                                              SHA-512:C368499667028180A922DD015980C29865AEF4A890C83E87AE29F6A27DC323DD729E6FB1C34A2168A148E6A7A972F65A5FC8ACE6981AF1D4E7057D99681CB366
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....C....................................... ! ..''**''555556666666666...C......................&.....&,$ $,(+&&&+(//,,//666666666666666........_.........................................:.......................r.!12BQ...3Aaq.."CRb.....#4$c.S.....................................................1A............?..p..-.....u0$.......l......)..o.FTd..DG....... .t*e..jO..Z.U......r..j.O.,..VD./.....V5D.&......A..Zi....E.N....*..........#..M<|.2.Y.../QO.x.cTM4......+.F;V.x.de*....]e..O.x.c\Y........r..j.O.,..T...hw..k.^.[B..J.sEl.w.x.m.5%zzt0..T.......b..<\.3Q..W</..!.xh6..Z..\.+M.o.Y..1............#.........|.a.l.KR>..U......e....@...\.1Z...Y...[....F.6.t.#..Z,.x.Q..[`.X......#........W</..TM..-H...V....Tf..........r..j.x.df.f.....#..l.KR>..U......e....@...\.1Z...Y..Y.us....D.)....Uh....FkYm.m`P...W .V.g..FjVj.\..1Q6.t.#..Z,.x.Q..[`.X......#........W</..TM..-H...V....Tf..........r..j.x.df.f.....#..l.KR>..U......e....@...\.1Z...Y..Y.us....D.)....

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002B.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 700x114, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2266
                                                                                                                                                              Entropy (8bit):5.563021222358941
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:TuRCTP9rSTfIEe1HbcVY1YbDXq8eCI0bf2QQe0GVDQAzZw:aRCTN7HbcW1YbDXq+I07Ien0AVw
                                                                                                                                                              MD5:DB8A181E3F0EAD4A9472099E42ED6BE3
                                                                                                                                                              SHA1:92096AF05CC6167B1AA816811A1160B809393FA2
                                                                                                                                                              SHA-256:E9746B4E9AE9CE7B3B0068779DB3E113E2DFC9880F25373D745D0E700E69A906
                                                                                                                                                              SHA-512:A9E246E10E28D057090BA9F034ECE6131780D7F794C5C9421523388997C7EDFBB49BC32B863B6C6668911B359C304AA54969B48CB9234950D5CECD2A6F3EFFF8
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....C....................................... ! ..''**''555556666666666...C......................&.....&,$ $,(+&&&+(//,,//666666666666666......r...........................................5.......................!1AQ..2a...."Rq..#3BSr..C..................................................................?...X.....U...j...F.W.V]'KV.uWt.iT...{.......`.(.....V%..=.....z......V..ct+.U.B...@.............................................{.....5.........0...x4....c..;...........+......|.7E.%.9.1+}..d.........+.V#.P.HUL.E...g.li...8.>U.";0pi.]5.\..zo..."@.........................................y.6.mLN..S.....@...i..A..p.......~|V9.+.Xy.........+,L.....7Z7..p...-X...\.....:-...i....v.1...-..H....9.zk....l....^.......:.."^.t.Q.F...X..B..$............................................a.%f&3..1.5+.X..'b7bwr.).e.x....!...H...aa_..kD...b..g..p..K^.k..qX.[,.........Q...U..x...YMvj...w..:k.....j.W.8..4....c.u.}m.....o.=@.......j.S.t.|.....5h.y.%.~...G

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002C.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.302475355813159
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:YVsgJmjjGWE2XI9e/8RQyoo4LRW74Nrp:msgcjq2XI9e/8RJoo4tW74Jp
                                                                                                                                                              MD5:FCD43CAFBAE1317C6A122271A2EEF065
                                                                                                                                                              SHA1:5128116DA7DE4992347113B0EA60045D7F77083A
                                                                                                                                                              SHA-256:420895E4C924B67A7897227882349B92D8CBDDC07F479A2D34FB5CC36CA3539D
                                                                                                                                                              SHA-512:3756B4228A77AC07BEC2C644579BC8881606E09A07D77A97334D0203425F5E9E48DA2252C9707B5FBDE37DB195FE8456F73C860ADA67B161EE865BB6E71C1198
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZE.q.....E.q...O.....2'..E.q...O.....2'..E.q..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............W..>L?..1.|8.......N...^.................h..v.N.(.'ILf.........f........................................I.qk..B.....LZ............W..>L?..1.|8...........W..>L?..1.|8............E.q.....E.q.....E.q.........................................E.qj....E.qT.]..E.q.....E.q..B..E.qH....E.q..B..E.q..>.)E.q..J...................;........4...4...4.."..............E.q.E.q.E.q..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........E.q.....E.q....#E.q............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002D.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 813 x 99, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):99293
                                                                                                                                                              Entropy (8bit):7.9690121496708555
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:Moq1jVORV5NO5xLCBaaNk4vhpCr1CH/DATOQlWvHMHojiaAMrxArLFRZPj19AWFz:eVEbouBaIk4T8uDGOQlVHvaAMkhDh95V
                                                                                                                                                              MD5:EA45266A770EEA27A24A5BB3BE688B14
                                                                                                                                                              SHA1:9F0B23B3C8EBA4FC3C521E875EF876FBE018F3C8
                                                                                                                                                              SHA-256:EDAD0F03E6FF99FEF9EF8E8B834CE74F26CD23C5F8C067F5CEE66F304181E64D
                                                                                                                                                              SHA-512:D4EE36BDA897BBD643A699A0332DD00DE9CDCC6F46D861789BAD259A4BF87868AE3B4CFAAB6DFAF29941C7055B77A95D76BAA86A4A0DB2BF3BAF7E3317F03EB9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...-...c............sBIT....|.d.....pHYs...........~.....tEXtSoftware.Macromedia Fireworks 8.h.x....tEXtCreation Time.05/15/06.8.p....prVWx..[Oh\E...y3kv........`.%m.R..6.1.4).o..Ki...D.......P!.].=..K...C[....f.}o7VPJIg...{3.|....d.....i..=.4.u0...n y......@j..Q..f)..mQ...4-SJ..9.d.?..5\-....:b.W..i...c.5..{..pj#.....B1C/.I.......].Su.k?.2..:.9Q...5.U...UZ...e..U.c],..2.}...1..)W./..Epr.Zt.....K.=..{......e..."...v..B.4.#....A.V1.".V}t..[..2f..Y..V9.".6.......(..gbm.P.....Y%2.c.z.:Q.2.<tYF.....u.@..KJ.;u.q:.].....$.....V....Hqk..DW.l.e.j.Z.YP?:'R..*.<........6...m@..r..j2..HK"|..L.Nc..D..y.9..B4$.......`.3.m1LE....7(OU\+./.O...%6T..w......h....).I.&n...*......#..W.41...5.#.`..I...<.?.|..*+Q.....#i........$,..n...`.s....[..E. T.w..j.,&-.r..;a....#.>(.P......f...MU\3*..;B....)..5....z..(....-...a.....}y.l..E...z>......&..g.$.....*T...N....E:./.>..#...^..E.0..%......(..@..W.X.NDM.<~.]A.>..fW.O.y.'...Z...h..).F..

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002E.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.315793095888774
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:YuqsrSYDdvQtCfEVpygX1pmP9WTotrdQqrOI2BXr6C4cekc6h:YtszdvQ6EPnX1sP9WTsRQyJ2Q6i6
                                                                                                                                                              MD5:108DFA5F6487CDB4851A79B1392546F0
                                                                                                                                                              SHA1:3A12AA61C03D33B3A16F2F032EB51A1998848ABA
                                                                                                                                                              SHA-256:0F7A19AE95D85F0A7334D958DC4A2A39F2B7B312C01260FC2E587FF8634BDEC7
                                                                                                                                                              SHA-512:9B1F9F542FFE111E7D567E711BCED19C75B4EE617D244A8336EAE6C0A03B896FD4091B51E842B9BA11C6EB8B07E57B514924815BD0D02E30F204EBA7832778A3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ._O......_O*.N.....<V.|.._O*.N.....<V.|.._O..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............yK89.....B.W.k.....N...^...............o@.)k.N....pR..........f........................................I.qk..B.....LZ.............yK89.....B.W.k..........yK89.....B.W.k..........._O......_O......_O.........................................._Oj....._OT.]..._O......_O..B..._OH....._O..B..._O..>.)._O..J...................;........4...4...4.."..............._O.._O.._O..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........._O......_O....#._O............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002F.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 780x107, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2898
                                                                                                                                                              Entropy (8bit):7.551512280854713
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:N9YMTXc4gpw+EIWnqQ5G+NE9VTzRFvS4+Xh+AKrNx+JuCluc3Eeky8etajhDCFex:/hDc4rPIoNEzbS4+XhOrGJu1cUHeoVey
                                                                                                                                                              MD5:7C7D9922101488124D2E4666709198AC
                                                                                                                                                              SHA1:00CC44A1B84D4D94A0ACE8834491EB5F65D04619
                                                                                                                                                              SHA-256:20016E5FA1A32DCE5AF4E92872597E36432185A7BB2E61C91F362BD68484529B
                                                                                                                                                              SHA-512:882944B2CF040485899128E03B7499C540D481E45FE8017DBF4FE0330157B2D8ABB7334DDB31C112BA0EFE3722A554883917C54155A7F60044D2D7F3D848260F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......k....".......................................2...........................c.....TUb...Sa...QRqr..............................!.....................Q...R..!..............?...$.)m.1...%%bV.J..H....-.%a[...I"WJ..:.X.:TT.$.......N.-NR.E..-NR.E...9..E....$.k.....B.I,I)..J...kr..+)..I,Yj..YbI..+,J..e..Z..V.e.$V..TV.X..V.YQZ.EQ..U%PY[.[.R.EP............................| F.. ...j*...!m.!j.I%.j.$...YeEYYEEUE..eY[.hEEUeEil.....%..el...V..TUYA.U.UTTUT.Z..UQQUQE...V.,...UlE.U[.lEP.P.@......................................R1...AR1m.....#..$:.T.p..IJ.t.....A..AH.,5..]F!a.XJFaa. ..a.!*.aa. X.e.......bB.b..,HX[,!..,,.c0.,..U..X..(,,...B(.,..4..B.`..".a..-......"...........................>D..IKEb...t.....)u.....)K.%+L\.J]i)*b.JR.IIL\i)u....T............T.....qs.it.iJ...])ZJb.....X....U.A...V1..B.R1....X...,.c...,%X...,%#0...,H

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002G.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.323599945625522
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:6NsvrgsrOIl4EShsXQWB9HkRQyRV3HgUTu279TM:6NsprOcfX/B9HkRJRV3
                                                                                                                                                              MD5:4B9C3E72D8F8CAD6036F44E005C1E74E
                                                                                                                                                              SHA1:F28ED31959356ED46B0F632986F0C81392E73F16
                                                                                                                                                              SHA-256:4C7C834CB4D33CC492F13122FF646ED50799F83D9BA6FF00720D2FAD0950A8E5
                                                                                                                                                              SHA-512:9AADF891537DDB53A34F0154B37F1199650627BFE537FB363B0D28FC97E1AABD6C0C01C7118504FF2462B77457265AD92CB6D984ED47A92EE922C6FD6E34B7EA
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|...........................4.......4...}.%....8.I.......I.qk..B.....LZ4...}.%....84....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............k.."@r..2.i.tQ.....N...^.................]9.=.E..E9..........f........................................I.qk..B.....LZ............k.."@r..2.i.tQ.........k.."@r..2.i.tQ..........4.......4.......4...........................................4..j....4..T.]..4.......4....B..4..H....4....B..4....>.)4....J...................;........4...4...4.."..............4...4...4....z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........4.......4......#4..............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002H.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 613x144, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):29187
                                                                                                                                                              Entropy (8bit):7.971308326749753
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:RwjBOlCk+nYnGagKJWJhwMJiRO22ZIm4VXvXx1tA6BQs:i8snY3JW7uROlEfbtVL
                                                                                                                                                              MD5:DF99CAAAB9A7DE97B63343E60A699AB6
                                                                                                                                                              SHA1:B84334135CFB73BC6EF55F85926770D5AC6DFEA8
                                                                                                                                                              SHA-256:74C131777E7C437FD654427417097BC01B0813BA8E1E50E4B937BD50A1BEBCDB
                                                                                                                                                              SHA-512:5D15AAAA8B71DDFE01A7C0ADE16D9E1F5E9AAE484BCD711B38CCB103ED9564CAAC23A0031471167B660E15972D70179C2A387509B213C05D60261042A0456025
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....C....................................................................C.........................................................................e..............................................`.............................!1Qq...2ARa..."#.....3BSbr...$4C...Tcs......%&DUd...E....56Fe....................................H........................!1Qa..Aq..."b....2R...BSr..#...3..Cc....$%4...............?...b.d.8T1.;#.S.DO...~.R.......3.xe...z.6..."m..k...;*.'.f.5^.....m..<$....8.R.j.D.v..>...*dT..vGbt...I......sEWp.r3.. ..G...6.....w...l.S..q...b.....-R....^Zu5+u6...A..Z].:...5..Uzn.,l.L.....?%.*.S.+zVg7.=.s.Q.....8..:,c.......ZE...>'IF..W.0.d.......c.e.d.V.t..S$.DNR.[....g..#i.$. .U.SK2.....k...J5u u\R.....T.[4..A.O..,.T..................] .i...B.m.^f....._...{S.....<......:..|D...+...NA....Y.^f.1|..%K~1..B..^...S..v=.c..g.tX[..kTJ..t.gr....R..@.F....5j..2.K.9..g.1N.....*.U...^w......>+.l.v...@N....%Qd...t.Ni.....0;lggm...K".+!.,.....[J...>..?f.]._;

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002I.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.343860804989015
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:MschXrlu1ByS+tAaW9EYYOt7KdXz81p92/oprdQqrERBXBI9THV:MsIr81ByS+qaGEYY6qXwp9MARQyoO
                                                                                                                                                              MD5:F25C90B4E8F41CF38D513AB459FD316F
                                                                                                                                                              SHA1:4F7BF670775852646969289315A50E1BBFD639EE
                                                                                                                                                              SHA-256:315AEC5DEA9AF44D29BD61E1881AD8487E4A5BD3BA2F751664C1610CD10346ED
                                                                                                                                                              SHA-512:12AF5825902913E746E6467381B5B3CB5D806443EB309935AA6CC93295E46DDCD50CE4B7ED7A3C3EBD339FEACCA13AEC5578F2D33DAFC2B5AC0A2FD8999C5BBE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZp.V.....p.V.Q`....|...Cp.V.Q`....|...Cp.V..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............|NX..m.<.;.......N...^...............(4.s.~@.p.,..Q6........f........................................I.qk..B.....LZ.............|NX..m.<.;............|NX..m.<.;............p.V.....p.V.....p.V.........................................p.Vj....p.VT.]..p.V.....p.V..B..p.VH....p.V..B..p.V..>.)p.V..J...................;........4...4...4.."..............p.V.p.V.p.V..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........p.V.....p.V....#p.V............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002J.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 276x139, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4819
                                                                                                                                                              Entropy (8bit):7.874649683222419
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:/hnQiz+ET2/hDi+tv34VtpWfowTHgegb6hhLT1NTS:5nQ6TAhLtvIzMvbi6hhF0
                                                                                                                                                              MD5:5D6C1F361BC04403555BE945E28E53FC
                                                                                                                                                              SHA1:00C254F7B3BC0289590C2BBDBB39C8EC2E2B2821
                                                                                                                                                              SHA-256:131D637CDC5D0B094FB9FAD17F4D2A1ACE0D03613588155AACAA2D1CB4E16DA9
                                                                                                                                                              SHA-512:34D2C0929FCC3CC10D0A2121BD55BFA9A07062C2A7B8F101071164C946895DBCB2777641E79DE4193D57A3F0778DD4F1351FAF333B7E4B4DBE31A32DD69C51F9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222...........".......................................<........................!1..AQaq"...2B...#Rb..r..$3CS.cs..................................................!1A............?.............u....p.p($.Y...9,j...V.*..S86yh.G.#m.5..9...6Y.."C.R:.[..-.7U3c:..].;.....f.?%..<T...&F.Lh.N...m]..x.D.g<B.....k..S........>j.K....#U..Z....<e.:..8....o..xq.[..4v..U..y...k... k....A#..A...pn.jJ.I.7:..{.b..ns.t,...8.Td.I....m.I.5Z.).-.. ]..X.Do%.....?..4jV.`llt.E...5...u.|..\F.=.F.r<...5dV....xc.%..&...4,...f...3..H.<......eQ...P.J....7...lLc..?..-.fR..7.#.6.......}:.]'.ny..........e;u.Y..$0...i..-....f..9(....}..T,.Inb...+=Cca7....WULA1@.s...4uY5.N.f.c..].ks.....3v..~..k..m)...f gNE`S......#.....Z..6.uc.m...#k.s.f*.l.$6..?..xC.Cm.`...N2..&H...._.&.E...[....f.Z./...!.a{K..#.V.5..v.B....1...9..B.&....%s.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002K.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.370757591306901
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:ysL5f4WzamtFWqzsenEnV5NqCXQnRC9WxoBrdQqrejnhBXX4Yk9/sngc4:ysh9zamvREVLqCXWC9WoRQyyiYQ2gc
                                                                                                                                                              MD5:2EEC5A4E3CC311C6BEFF588508C9F454
                                                                                                                                                              SHA1:52F1C27B4BE695C8539F2DE6791E675CDF5F3511
                                                                                                                                                              SHA-256:93FDD4D0319399CCE4C7F2BE41EC8496462309524FC5FCE4338A60E940FA21D7
                                                                                                                                                              SHA-512:1D90DF08AE7E76D76E730FF725AB3277BBD84CD059DA8CABE9B2FE2E84B322F006ED97C78F76A10A755E6FF31397C0FE9D9C422C0F24ADA819AF42DDE338DFD0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......V...v...J...................................................................................................................................2...>...2.......v...~............................I.......I.qk..B.....LZ............9X............9X.............I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............N...6........F.....N...^................./....L.U..............f........................................I.qk..B.....LZ............N...6........F.........N...6........F.........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002L.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 814x45, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1717
                                                                                                                                                              Entropy (8bit):7.154087739587035
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:N9YMzO6BOfqH/dAIWpdAIWpdAIWpdAIWUtr/SD:/hzJgfqHaPYPYPYPUt/i
                                                                                                                                                              MD5:943371B39CA847674998535110462220
                                                                                                                                                              SHA1:5CA79B7BD7E0E93271463FAEF3280F1644CBA073
                                                                                                                                                              SHA-256:9C552717E8D5079BBB226948641FF13532DF3D7BE434C6CE545F1692FA57D45A
                                                                                                                                                              SHA-512:812541836C8B6F356A4D530E5CCF1CFDCC4CA54AF048CAC19FE86707CE5EA0F41D73C501821AC627AD330291EF58C040DFC017923A7886CEEC308048DA2CE7C9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......-...."........................................&.....................U.....1T..S.R.Q.................................................R....Q.a............?..d.. ...............................................+A...Z+E...V+E...U..R.....}........Q..Ah....Ah..b.AX..b.PZ+A...V+E...V..J*....Q...b.Q..Ah....Ah..b.Ah..b.PZ*.(.@z.?.`;2.......................................................Q...b.Q..EZ*.(..Z>.G.....`Z+E......J*....F+D...F+E.......b.Q...h....PZ+E...V+E......J*....F+D...F+E..............[u#...a-...f<.9^[...l0..H..6.Kn.t...&..3a...GG...[u#..8.y6.q..%.R:8....6a.+.3..a-....l0..H..9^M..f..m..3a...GM.q..m..6.Kn.tq..%.R:l.W.lg...[u#...a-...f.r..c8.....f..m..0.....l0..H..6.Kn.t...&..3a...GG...[u#..8.y6.q..%.R:8....6a.+.3..a-....l0..H..9^M..f..m..3a...GM.q..m..6.Kn.tq..%.R:l.W.lg...[u#...a-...f.r..c8.....f..m.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002M.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.365552212164579
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:g9zswOaHjeElq5cgntz+EKd79JXckB9CoEVQoBrdQqrJ7ypBXGoajGloKMszlIg:g9zs7V5cUsEKd5JXjB9NIRQy8pPlI
                                                                                                                                                              MD5:728197D5F297BA325D4219BC7FA49984
                                                                                                                                                              SHA1:EA91A1BD3A63A73AFD1139DCEB5AAC9B325B531B
                                                                                                                                                              SHA-256:6DE7EC83945782BA6ADA9E397D80F76995BF83150C2D42916E7DB5695D1A885B
                                                                                                                                                              SHA-512:8A0034D49B771DF29D2B2F3DCACED675D93DA80A2195B0A611EE99C4928D433D1C48A42F768A3BF608903E0B8A2CC370A36AAF94D6C6F7668F65DFAE9AE819B9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|.......................................B...@.[..I.......I.qk..B.....LZ.....B...@.[.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............H.....0....hg....N...^...............S%.q}t&O..z..}........f........................................I.qk..B.....LZ..............H.....0....hg..........H.....0....hg....................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4......................#..............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002N.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 262x277, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3555
                                                                                                                                                              Entropy (8bit):7.686253071499049
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:/h3JeYCQV5Hn++9HBdAjU78S/mjLLwqnqahJD:53Je8b+EBdAjm8S/mjLLRnphJD
                                                                                                                                                              MD5:8A5444524F467A45A5A10245F89C855A
                                                                                                                                                              SHA1:ACE68D567B02B68275E0345C86DB1139C0EC1386
                                                                                                                                                              SHA-256:7D2B01F17354D9237A6AB99D5B9AFDF0E1CC43687125848B0C2DEDFB44CE3843
                                                                                                                                                              SHA-512:8151B447B60D110C32EC1EF286B941FFC09B99140F41BBACF5A1650A385FF4D13C0DDB2878E9A470FC7CFCC95A1AB6E44F6DE72562B0FFE093DC8A3C3C7FCC14
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222...........".......................................2........................!1AQ.a."2q.B..#R...3C................................ .......................!1.AQBq............?........)&vD.)3Hn*..X+....r...tmL.k..(.E...R. .Z..&...,fJ...!...6..S\t3.=...g&..Bqe.)_U.....1......-..fl.................J...u.i.mU..K..v.w.0O..E.h..D~K.(..9.,8..E.}.............i.\.....t."v..q..C............<..|3.........................*Q..../c.....f.}8....D..|k..Z......0..~..c..e..m(...|.c..'.5.5............==bx.5x.8...T;....=.--.pc...I;.V.m..,(....}...NH.ho....Q..U.E$.~...w.t>.S\....'f.{.+.g._.t....;>.....P...........-..G.h..2...J.% !.E97Ir.D..N....j...oE._...._...".?.......#".S.........Q.Tc.I..*I..k.......=$.........sk1Jp.\K.....F.3.Q..q..J....N..[l.&....OR4bB|..2ul....J...B.$&H..9#j.f.n./........?R~....B.I.@..........m

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002O.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.3345935389747705
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:csJImZgbIfeEDXKp9W+ZRQyE2lpim1397A:csRgbUDX89W+ZRJvf
                                                                                                                                                              MD5:76034FE999FBF328409898788D44E459
                                                                                                                                                              SHA1:17D25C15D098C8DA0DF4F2C4C43AC9EF50FF8175
                                                                                                                                                              SHA-256:84A6AC2454A81EA7D35D3925B8C40B766C0E249097485A5581EB0C4F05E861E9
                                                                                                                                                              SHA-512:0C179F50CEE0E32D5D760E69333C6BA9F0A7A0515334C69D9FB06A93B6F5A2B595A55B696D2C00D10CCF635EEB75B09A624F742A6134B320308E1CE5A7952001
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ..?.......?..<..#k...h....?..<..#k...h....?..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............@<....'......2.....N...^.................D.}.O..gM.l.........f........................................I.qk..B.....LZ............@<....'......2.........@<....'......2............?.......?.......?...........................................?j......?T.]....?.......?..B....?H......?..B....?..>.)..?..J...................;........4...4...4.."................?...?...?..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4...........?.......?....#..?............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002P.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 70x626, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3428
                                                                                                                                                              Entropy (8bit):7.766473352510893
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:/hdu7isPwAp7zesusUyYAatNG87llTONQYS:5di5tfuQ9atNZlaC
                                                                                                                                                              MD5:EE9E2DF458733B61333E8A82F7A2613D
                                                                                                                                                              SHA1:A86704C969F51B86D6A05ED51C6C60214ED9FA89
                                                                                                                                                              SHA-256:BE4F0E6C89FCE91B9EBD2623567F7DFC259E0E3C77C9158742B8F64B724DF673
                                                                                                                                                              SHA-512:BFB5D6DD6B66EE21E946E90D1E482384CD10244308562DDA814189602681DADDE5752B80519E5B8515F115A71BD6BB4317A59BE65B8B5E3474AED119F8303569
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......r.F.."........................................H............................!Qaq.."12.....#3ARbr...$B...cd...&CSu.....................................+.......................12..aAQ.!#q.."................?...#...3.Za......rV.5&...../"..i.t...j..W........d.FL.V.2K....]t.f.d.NK..:.....f...... ......2.[...#..D...ZK....p.z.E.N..T..L.-....1....2.\.6FIr2..zS\U#..........fB\t..5J..~q...D....A.......!....MY..../.HY..../e.M.Y.n.~..,....'..Pc...l...d2..m.f.it$..qx-z*...._..].cOO....n..&.....FIA.....2J2..d:<qc..6.I.G.N....f.K..Dx.-.......`....2.FZ."K7.r}..<.P.Z.da.Y.....8..s....G.....b.e..g .S.......FL.Z,&..q.MG.J+..x\..m...qN=.....)..`...&Y...S....u6{.z.g.....@......FL.ZL&.Iv.w..8....U..v...*.q.B.v_./A..#.#.g.j........*J;...u...W.Ao...%....#$.....M..^\{W.SO...s,.N.....c).,.B.Gv...."k..z."..S]H.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002Q.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.3430895769530355
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:sslW6MlPEXNrxdXI9HkRQyw/TOyaTAPM:sslW6ZXNPXI9HkRJw/TOyaTQM
                                                                                                                                                              MD5:EC5EAAE989CEC96ADE6223EB1C6FEE8C
                                                                                                                                                              SHA1:84482A6D78CA5D18A7A0855DBA45ADB43EB14F1F
                                                                                                                                                              SHA-256:B5299FBDB74686F0E2039605AF52CEE9A28395AE6DFF2777F463FB1D55A3EBFF
                                                                                                                                                              SHA-512:0B2327A5C8F0EC04B5A903381074A60024ABE7AEA5D6693CA011237DD4AB77619FC3141B6C4C30D85C986C05792F0F03075D7A0BA4FCB4033C304846FE76C6C9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZtf......tf.Z.......}.FMBtf.Z.......}.FMBtf...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............I.p.>.y.7/..gw.K....N...^...............R......O."...".........f........................................I.qk..B.....LZ............I.p.>.y.7/..gw.K........I.p.>.y.7/..gw.K.........tf......tf......tf..........................................tf.j....tf.T.]..tf......tf..B..tf.H....tf...B..tf...>.)tf...J...................;........4...4...4.."..............tf..tf..tf...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........tf......tf.....#tf.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002R.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 177 x 123, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):65589
                                                                                                                                                              Entropy (8bit):7.960181939300061
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:2Hlrjw3xL//DPgff+9j6yPWvHMHjkbfnwHO3AW3GL:2H2zDUU+yPVHITwNfL
                                                                                                                                                              MD5:8B48DA9F89264D14B83FF9969F869577
                                                                                                                                                              SHA1:E1BD58E2D80FEEF56DC514F3F0B3AB9669F22F95
                                                                                                                                                              SHA-256:62AD3C277E54F03F1ADB44062407346F789E63859B7AFABFD64BE6AF5E9F66EC
                                                                                                                                                              SHA-512:03B783EC968DF3F648504D068D64DD1AE110E28110FE5B3401C9D04F44897DBE0CBB5680D42CA4C665FA94A6CED4B559106EB3C06C9BF2C5B14951ECBFFAC8AE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR.......{.....;Za.....sBIT....|.d.....pHYs...........~.....tEXtSoftware.Macromedia Fireworks 8.h.x....tEXtCreation Time.05/15/06.8.p....prVWx..Y=.+I....t.y...,^vv....;. "|. .i7.....$.2g..']pH@p..]b....H.H.......d'@ B...U.xm..3{3k?..5n.._}U...3......~..>...g.....f..t...t:...p>..Si..d:..k:.Lf..t6.K.i....d<...x.8\.8.+lc...)i.$.r.....x.t.BG.R.cm.c...p.:&.6.4..K.......^...~b].0....oBYv..u.'.=.K.Q.g)6.....4.!.M......4.=....G.%.Sr........nxC.F..t.U........1...J.t..eQ....".... |...81.$D.!.>...........$...^.vY..EY8tb..'.P.g#O....S*..0'.V....x.W..........k.......s.C.S...J%.iVb..].........3....j.}*.z....+.s..@..K.....\x.C..e.Qq.....;N.....;....,....^.*..$F..{G...8.#....8'..&....8..5.....3(P._....S......|".....u.cr....+a-....&V..x...iI-<|a.{E.c.X.......?..&.C....'........(.x....>...M.?.9..#X......l...0...Z.F..<.z.0}Q..Z1..........?h..`E$K.2o.A*c^.......*..D..uL=.}.#*0.. M!.A.C......|_..(.Y........!E... .O...`;....M+..x.u~g...q>...N."D^..K..x..D.`.!.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002S.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.3557590349678925
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:WsFbd7GmzLt8q9/EmdPrkXR0isk9mdo1rdQqr0FCeBX6C/kjOZ+PF:WsqmzLmqtEmdoXRH79mcRQyYCe8McrP
                                                                                                                                                              MD5:F11FA635B348C1978987308FB6CB21F2
                                                                                                                                                              SHA1:A43D63EED219C814F6572269600E9C064DF978FF
                                                                                                                                                              SHA-256:61C3FF80345EF103D63D2D305451A6D70B9A2DA96FE9975C62BDE1A656270073
                                                                                                                                                              SHA-512:93543896208BB469095C985D638D5F42CA4CFC3E36840EC31124F2BF9571D700FEE9D8E52D1DF471F0176FB8E3618A68EFBAFBBE7D71B9A1A2677B958804D198
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......V...v...J...................................................................................................................................2...>...2.......v...~............................I.......I.qk..B.....LZ............S....1d..f.....S....1d..f......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............\+..go......4.......N...^................T..%.K.Y.w..*?........f........................................I.qk..B.....LZ............\+..go......4...........\+..go......4...........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002T.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 17x608, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1873
                                                                                                                                                              Entropy (8bit):7.534961703340853
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:N9YMw9kGzE4xTdow1C3kyIkyM66KeJY3fOxJ:/h8HzE4xTdoUCUyxyD6LCvSJ
                                                                                                                                                              MD5:4FC8500BD304AD127AF4B5E269DFF59B
                                                                                                                                                              SHA1:9A5E3432358A0FCDECE86AEB967319B93A65D14A
                                                                                                                                                              SHA-256:B4DAA90D5A53FCBC85119050B5B76962443C4DD18D7F42CDC6D4E0AD8EFAD872
                                                                                                                                                              SHA-512:E5E07054A522EB91EFD39722AFB3776389632B8F5F923C1D29796716D68CEC93BE5E44F79913804CEC7ED631FF520CBBBAAB841E01FB90AF8E8ADF84DCD47481
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......`...."........................................>.......................tu.....45.!#$%1s."fr...2Fq..AQe.Eav............................... .........................!AQR.............?..e4.bbu."m.G......u.S.-Qq.b.a..'#..E.......u.|:.f[O..jS.S.&....=.....[.....S...N.~~...'...q....N.T.Oyf..a.6..%.I.1j.e~.4..[5.WW.Y..Xp.gn...u.......Gb.O.W..k.!mJgfq....~.F.......m..}bn4.5........s,F...z.b)..O..*...5).-.-\....=`.fP....%...A..Q.&..9.....QQbD.%.:u.f...r$.10..W.F.T..MI...9...ZQH._..).....D..n.F].........*.:.j...!6Z..S....0...B.6..Ga..S.O.....U8S_.J.>...i..?..<.P..........M..F.T.C..7.E...`.4BKcMh1j....4y...+.|.^......2[.WG.W..+......E..r/V^".R...."..6..hht..f...........;E..Kx....)}Le.A.x.>..$/).._S.n.L......}..H^Sw...2. .v.io...../.........x.>..$/).._S.n.t^;O.....n...[.S...h.v.io...../....:/...[..7yK.c-

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002U.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.453492556986942
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:KBsWNhhQXyli7nSmctUEe9Xy9XJEAo/rdQVru+JBXTpikCQNhep3sl:WsalKnjcWESXy9/CRQ5jH
                                                                                                                                                              MD5:2A32D4FE24F92B0501C78020C01E03E4
                                                                                                                                                              SHA1:5557B7D20E0EA35D1B82F9A3555A8B61DA7DB773
                                                                                                                                                              SHA-256:DDE7F895FA057381615E12FAB911B8C3C7568DB584936E84D85765F2C66F1944
                                                                                                                                                              SHA-512:50F74E32CED1E86EBF25F889C88B3FBA74AF6766977A58E8830808A55A2163A1D30ED109308C45853340BE8A485BAC2B534EA2D3BDA3AF2750D794986B8CAB53
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......n...v...b...................................................................................................................................2...>...J.......v................................I.......I.qk..B.....LZ.q"......q"..O...W..4....q"..O...W..4....q"..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............6..a....!IG.........N...^................L.....E....|...........Z........................................I.qk..B.....LZ............6..a....!IG.............6..a....!IG...............q"......q"......q"..........................................q"j.....q"T$c...q"......q"..G...q"..H...q"..>...q"......q" .3...................;........4...4...4.."...............q"..q"..q"..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........q"......q"....#.q"............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002V.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 357x69, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):5465
                                                                                                                                                              Entropy (8bit):7.79401348966645
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:X0cZneDWlIKmXwxacOHHI6EhzNlSSDDgafbofgt7mGrw:XleDWlIJwQHihRdgu8imGk
                                                                                                                                                              MD5:8470F9A96B6C6CAD9EE60961E96D19B2
                                                                                                                                                              SHA1:AFE1F01FFA4E4CB06B1D770C9C59DA75B434D1AC
                                                                                                                                                              SHA-256:2DF453410796AEC7B9EFEC00059B6CE64BCF67313A95AE458BA600EA5DE14811
                                                                                                                                                              SHA-512:CAE5C2ED091BA49761F0348516D53491E578FB165F32F93AC7DAD927383E9A398B06229FAC6A8233777DF708E5001AE0037A1FA960293BDA49892C40B37F2240
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....C....................................................................C.......................................................................E.e.............................................8...............................!"1...2A#Qa.$34bBDSqt..........................................................?.....`0.....O...3Sd..@..5.0....Q.pw....;....!pN.DR....`0......N^...k.=.u.e.7{.b........?z....zV...M.....P:a.SPj.....WRK.=x.2.h..2..AS..s..A..|.Z/f$D.YX1pr......}G6._.~..)j...+.s.r".{..q..-.^@...#w|.H..*.K)....g...y..`0......2.w@.Ro.d....@...K....}...&... y..f.y.0.|DC..>p.[E.2......v..N.)Z..4.RF.D.8]..Z.|f/..+\ID.r/.o........0i..*.G.O..uj..RN. ....j...xnF...Q.Ls.U.c.D0m....z.k.P;f...b.=..L.hH.,./;.U..`sa.I...?*...I....M.0<.u....!..C..U.T.....s.Q......_..7K..*.....?....R\&=.<.u..oQ}WZ..Yu...{Fe3.h...@.s..mW.G..^....1.W.#[.q2.&u.c.G......`J./..X.C....M;.....3k$}.i.3...#/x.m.Oh.}FH]. ..5NNDIS.-.M~...6..w.d....P.;..k...........v*..T..L.P...s.!B.4..w

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000030.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 14x341, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3361
                                                                                                                                                              Entropy (8bit):7.619405839796034
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:zDqnxqMt6gGr/Nln5ANln5ANln5ANln5ANln5ANln5ANln5ANllHN6:CxqMQr/rn5Arn5Arn5Arn5Arn5Arn5AN
                                                                                                                                                              MD5:A994063FF2ABEB78917C5382B2F5FA8C
                                                                                                                                                              SHA1:BD5C4D816B04A2B6596DFE38DB01228F553FACCC
                                                                                                                                                              SHA-256:D72900E8DA72D1A7F3729971AA558E1E9B6E9CF9A0D51E83852E567256DBBFEF
                                                                                                                                                              SHA-512:CF2279033DD3EDFE6F6F9E5C517BEBD9A52863EEFD90F57F7A5AE0E0485E705254BE7ED6B50E6CA142669687727AE85E2E6035F69930B75F2E6D3EEFA961EF88
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....C....................................................................C.......................................................................U..........................................>...............................8H........59...$%&7F#'Ddf.....................................>.................................58EG........!#124$%&ACFbcde............?...n.p..v..a.~.._.>......#....8.....w.G...&.W...i...%6m..K;...4."...=..?.~......P..O...j.l..AW.jo..,..=d.h.ta..../.."...z|).J.......Ww._..<Wp.3+8...-5...G:..2.D..I>o..K.F;-.....#...`...6..T...M.....OOgV~..5...np...P..TYr...........b..{r.2.9..].DA.%C....=.v.z......CK."..R..l..y}.i..;.{....JzS.....~.?..Z....=c.h~*..p.@(@..G.....O.]...Hsd.xf".V]..S"..w...4e>....3*U.7..|M.x...|\......FD./.cIe.;.bId..+=...w.......[.k>....}.u...j.xZ.....Q4..+.....B....1O~\......I..h....LaXJ%&.w.<C...n/`.W..U.W.U.}~...}>..^.0.J.....@....LN.b.......5W...m].Eu...:....G..:4.=4ixx..@_0=.mab.T.U.....w..~.V.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000031.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.351169907831065
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:OsP0m7DBqCEbXXJ9Ujf8RQyPtDnmdkJTTR:OsP0m7DabXXJ9Of8RJPtDnmdkJTT
                                                                                                                                                              MD5:59941286288F0318AF16F44CCCFE53BE
                                                                                                                                                              SHA1:30D99275A24D2868A3C2866DC78223D1763BCD83
                                                                                                                                                              SHA-256:F50C4EB193F07012B11A65AC0B85EB9EB8926B9AC81748F9D6B66076F4530CD7
                                                                                                                                                              SHA-512:ADCBBCD355E18542A53EF713540625868F6AC29EBF56494B6C9D5A5F76DBD80506F8D78551B207325EC68B018FAB277D94523ECE275A86E849344D118FAD8DCD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZg*......g*.s.V...\+]...tg*.s.V...\+]...tg*...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................c[...A....Dz....N...^................]E.g2)C.S.n..G.........f........................................I.qk..B.....LZ................c[...A....Dz............c[...A....Dz.........g*......g*......g*..........................................g*.j....g*.T.]..g*......g*...B..g*.H....g*...B..g*...>.)g*...J...................;........4...4...4.."..............g*..g*..g*...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........g*......g*.....#g*.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000032.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:15:20], progressive, precision 8, 604x784, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):140755
                                                                                                                                                              Entropy (8bit):7.9013245181576695
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:i/aDiblRsFcOco8dofE5Zx1+NQI8Wh9aiOe5NTO:mnbM+TxaAi98W3aiOwTO
                                                                                                                                                              MD5:CC087700C07D674D69AFDFDA0FA9825C
                                                                                                                                                              SHA1:F11113DF69DACDB255C6CBCFB29C1D1CCE40B346
                                                                                                                                                              SHA-256:A7FA7F092EFF43030A56342C39A765F8D5CC48C7DB815DDFC8C1E5EC40117FAE
                                                                                                                                                              SHA-512:843202D975EFA91E73287052A893584B6E5AE601F91612B56539AA2F73D1AD3F997FCAD1E711E0F483A2E91D46D9643D0B026B43F4E94116A5D2FB6551536034
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:15:20.............................\.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................{.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.......J...\O.,......../$..........OE.m.o......T....Z..l.g.-....m.?...Y....3......"....].j.X.k.S.k.....4..R....{....?F.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000033.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.350090397659957
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:Y1sdz6ApiDUvIGMEuVuXlW9StARQywZqz/9zrzazgz/9zMVzOz/:OsMAp+UnpuVuXlW9StARJwZW7R
                                                                                                                                                              MD5:E08034AA84668FCD84B38C29B1781D8A
                                                                                                                                                              SHA1:213474F9857515991D77CB6F6736FB60A80DC7D8
                                                                                                                                                              SHA-256:1EC816F2BED5F5C2226FF97133409AE82FBDDFDB3170F263AE541A6712BD29F2
                                                                                                                                                              SHA-512:A148A990E139C9B30AB26842B07BE808FF1050DB0C58998FB6CC2F9C2C2C4605C5BE120782C5FB391E8E60A9C744DFBCE013DCE40F30B76864700343BC24D334
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZD.......D........^*.n1_AD........^*.n1_AD....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............0.......+..8..Y.....N...^................n|.57.N.^.W.*.5........f........................................I.qk..B.....LZ............0.......+..8..Y.........0.......+..8..Y..........D.......D.......D...........................................D..j....D..T.]..D.......D...B..D..H....D....B..D....>.)D....J...................;........4...4...4.."..............D...D...D....z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........D.......D......#D..............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000034.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:13:06], progressive, precision 8, 570x779, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129887
                                                                                                                                                              Entropy (8bit):7.8877849553452695
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:QS1x1rXglsteJ79wHi4vNQR5yBlUdOSILe9hSj9jeWMPjdlOJ:vvglst1HiwWR5yBA2LeS9jd1
                                                                                                                                                              MD5:737E96E41D79D3BDACE7AB4F8CBF6274
                                                                                                                                                              SHA1:E6202A41A4F86B27D9EBCAEF7670B16C0ED67CF2
                                                                                                                                                              SHA-256:7966F3D8A2D61ECB49A35E163781858E052C0B122A18A1238AFE27B57E2850E8
                                                                                                                                                              SHA-512:D398C8521DB2FB3F8456FE792CF37472F3B851DD7298DB20E2DB79144F8E846D051878E77E5EF5D00E6840EDB90C6E2D97935BC1023A15FC45038CCE731E9895
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....iExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:13:06.............................:.......................................................&.(.................................3.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................u.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...W..I:..*....a....Aa ...w.T.M.v.........3x.......8Y....$.."-..m.I.0~sxB[@..=...:..\.Y?....@O.L;9i..U....?.5">+9.s\Z..vN

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000035.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.340696605986021
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:Yz2AsHhVNK/T4BEr7vXYT96V/QRQydR5XItmXn8hE:02AsHhVNK/0er7vXA9O/QRJdR5XItmXP
                                                                                                                                                              MD5:360A84CAD556F661041247F94EF603EA
                                                                                                                                                              SHA1:FD505163BE1FFE263CDDC74732CA0231AE5554CF
                                                                                                                                                              SHA-256:486F961648AE9B2B37BEEFEA03EFBB081729CC82512DC4A0CC2255E17D9BFD91
                                                                                                                                                              SHA-512:630651EB38C7451E98CEFF633388650023FD7F60C70F30CEAE4BF7CCCF920C2F26DFCA276BEF8E101C717DA8A7D063A41DF7405519A2075BC125D8D6888EBBC5
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ.............p.../..2.....p.../..2.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............Ov.....%f.V.1....N...^................%.+%.oJ.....;........f........................................I.qk..B.....LZ.............Ov.....%f.V.1.........Ov.....%f.V.1........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000036.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):84941
                                                                                                                                                              Entropy (8bit):7.966881945560921
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:X3sWfhTVd+xu6rA6SOONM0/YFXnviDwoPCaNSm+z/ze/fWNj7GfigeKyCGzw+QKW:nsOhdDJOwY1voPCaom+z/zeHAfGihCG8
                                                                                                                                                              MD5:CB84C108A76C2AFFCAC2551A3C1EAD56
                                                                                                                                                              SHA1:8BB7C2A12B056C1ED12EBBAE5BC9F60CCE880FFE
                                                                                                                                                              SHA-256:139BB0E79F89C3DDEF79B1716A5FBAB4C07DF5785FB3CDF6B4EEDDBF6C078452
                                                                                                                                                              SHA-512:6EF85144E9A7ACD0FF2E52A5FF42093153EFB69127B1C8549EEBC49B6CC196A46B65EE39A2CAD0206F6A41476D8B5B35D29EAC9942B8F84972B32E14CAFEED27
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d....................................................................................!.1A.Qa..q...........".2..BRbr#.T.3C....S$.cs.D..4%5......................!1A..Qaq."2..BR....3...b#.r.C4.............?.......m.q..'O.....r......_.1....8h....?.....O]~..k......GO...''._...!....o........''..g..H?k.......1...?.....z......>...+0..................GO...''._.........}.O.Z|.L?...........?.........[~t.......}......NO.....v.......J.......?..g..H?k......GO,m..r}o.z.....}......dC.9?..g..H_..........?.....O]~...m...C?.z..f....W.=u.B..m..C.-?.a.....3._.?.......o....np.M....g..H_............9?..g..H...../..kO...''._...!~...o.....0.M....g..H.........../......O]~.~...o.......7..+.... ..l?.}........&....3._./....?.........W.=u.C..m..C.+?..o.W.=u.A.^.O....:......_.........}..t

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000037.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.3363108759636635
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:Yu6sKrZXhCOnNAZt+HuEe+h3XLU9+ootrdQqrjx6wzoBXihYCPtCnFwB:Yds6NAZDEPFXw9+okRQyF6NG
                                                                                                                                                              MD5:7DCFDD5A12B9C4500750A975820E06C4
                                                                                                                                                              SHA1:84776903B23B5E2EB6083898851E820E3B1043DE
                                                                                                                                                              SHA-256:3C38925DBE9CD37BA5F81FEABFF54F40BF657C083800CA6E5B05F1DD947A5F5A
                                                                                                                                                              SHA-512:3EE2F3477FBB375B8F6B63DD4C95DB51F6C58185E4ABFD60F6E267535C010A377CDDBE3F3C3F3AC7D615153530271AA5119473195B4CA4D89A53BA36CA8C70DA
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ]T9.....]T9...i..-..m..]T9...i..-..m..]T9..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................W...R.\.......N...^...............;..C.%AK.......$........f........................................I.qk..B.....LZ.................W...R.\................W...R.\............]T9.....]T9.....]T9.........................................]T9j....]T9T.]..]T9.....]T9..B..]T9H....]T9..B..]T9..>.)]T9..J...................;........4...4...4.."..............]T9.]T9.]T9..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........]T9.....]T9....#]T9............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000038.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 40 x 623, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1569
                                                                                                                                                              Entropy (8bit):7.583832946136897
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:KArPoy/sSfmBL0EGEsRgeTLLXFnViAAEslVorlP0i8OmO57EnGAkYelBKMN:9oQPTgeL5ViAe8rQs7HAkrlc+
                                                                                                                                                              MD5:07DB3F43DE7C1392C67802E74707DAA6
                                                                                                                                                              SHA1:C173ADB1999065C5E1E6DBEF934B4D4D7AF0CC23
                                                                                                                                                              SHA-256:51E05999A1C9F17DF28CB474E57DD8E64BDAB824874A532C20A23766A01F8967
                                                                                                                                                              SHA-512:E509255519D4E521E82332FF418DD5A6BBBC8476399A0D9C3D81542C1CABA535B2D79E5BC90F73F9EE8468643302137671934ABD600FC696F16161C91FEAC111
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...(...o.....>.c.....PLTE................................................................................................................................................................................................a.o.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.Y.. ..........}%.../].`<..y....V...m.....<....)..;Ki..'9...2.:.c...t..V..d.t;-y.Z.=K>B.."{Lj.~G..|..ENC.!Sw,....";.p..g....E.B..S.-...k..P."..E......l[./D.-.....Q+.G<>.+..b...#..y(...{a.M..J...<....v.W..F.qm.`.....(.mk.nX....l.Px8.0\Z....7G...$*.....&..Z.VJ.~......J.2|...2H..../...=.)q....ZT" .,%..h.p....Z$.!........r...Hh.f. ....P .d..1d....2.3h....;.A.... ....d..g4...A..^.....2.ew..."h...y/..j.h..B.......%.2.%..{r...+dG.=9h....P1...A...c...^h.]Q0.8x....q .!3....ZW"Z.!3...G.vC.GG..".&..X!3.|xB..V.P!.+zS..NX!3.....Nh.y(.Z.1.h..B...Z+....l8Xcu.B...K...@U..@Q...mB...x...&L C....mB.....@kC...Y.,.... ..e\F.B..........y..e\..:$(....Z.a...yn...f..z.~Q.{o...].ln.r....^.@.{..c.7..{...

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000039.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.358263934208726
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:IsJ+uKQkpdEplMXs9uUARQyAtu1PZtTe:IsJ+uKQq6plMXs9uUARJAtu1PZtT
                                                                                                                                                              MD5:28759D49D0F9A2DA07341A4FF627D1D5
                                                                                                                                                              SHA1:67EFB4FA9E7C4DE53389B1154425649E62129186
                                                                                                                                                              SHA-256:5B4B84E4D12E510D04E07945D62E2E14DE0401FE52EB09D6E8D50806AB0890AA
                                                                                                                                                              SHA-512:823D5F5F30701F31545FF5C2FF6078D111120BFE1D0869A35EAA2E98510967EA1BE5F0F120B300DCE4F66793B0034BE8566AD62D7AE9B65E95AD5E0C5B51443F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ..T.......T....3.G....`..T....3.G....`..T..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............>M......6Z...{W....N...^.................3....G....5W.t........f........................................I.qk..B.....LZ.............>M......6Z...{W.........>M......6Z...{W...........T.......T.......T...........................................Tj......TT.]....T.......T..B....TH......T..B....T..>.)..T..J...................;........4...4...4.."................T...T...T..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4...........T.......T....#..T............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003A.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):40035
                                                                                                                                                              Entropy (8bit):7.360144465307449
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:MQhziQo1RKGlyyzYjlxuxwRUj/BN837xRmwH2uDTCn8qXFQziN:ThzrSzalg6O563l4uTC8q1Ig
                                                                                                                                                              MD5:B1DDD365D87605F96D72042CB56572F6
                                                                                                                                                              SHA1:ADF71DAD1A62B8A58A657C2EDBDD665A19EB846B
                                                                                                                                                              SHA-256:06E09DE80C3F32254DA4FE6B2CBAD7C05EF144DD54B8C65745E195BBF7317A2E
                                                                                                                                                              SHA-512:9C686092CC9524F34EA6CEC9AAE936A6225BCC54DE38DE1786EBA8F532959A80FF885E8664A09E4C318D7CA4B278E807D3D1F135BE55F30979B844FF5EC9699A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!1....AQ.aq.....".3.5...2B#s.$%..Rr.CS4&6...bE'7.c.DTtU...d.eu...VFfv.Gw.....Wg......................!...1AQaq........"2..4..Rbr#3$...B.s5Cc.S%.D............?..^.f....R*.N{.{f.....O.r.V.;U..~...U.(..>M._.yI.{8,..^.t...s`...j.O..U5t.&&..h.G.6Da.;.....J.......E..QD...C...}..N...tR.....~..].J:.V$.*.r......]...W......4.[.)6..Y_.....4...........m._'HR.a......]U=.....n...0.W..]..K..){.+...w...f...<|..1/.|.....b..-..y....]U#Ctn.7m.._.|..2I;|....tM....q.q.}.N)....'...9&...nR...R..}.........m._.LZ}u.../K....9.~..?.{....V.#..dx.Zk.:=..:.j].....E#....E~w%....J..[S..[......gr...vb.r]..<..ut..i...[P.w....:..Gkn>......#..m...9km`......t).up.....w....VOR.{&.nQI..}...wD.7Ey#n....MO.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003B.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.643999699408699
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:RsqdvH5Utr9/E3/LCDsXsXs92/loxrdQqrrOBXt8seJN:RsyH5UPE3/IsXMs929gRQyie
                                                                                                                                                              MD5:E6F262F023C7B5C3B8B9482FA97208D1
                                                                                                                                                              SHA1:6B868A51D17E260B6DF85E193468264594E8F2DD
                                                                                                                                                              SHA-256:42C318CE00303346B77B9ED7FD07F7DDA675C3EF8ADE38F5E53672C8BD084308
                                                                                                                                                              SHA-512:4D904E9EB4F7D6E1CC18F39A6EBFD0A8338B5F1E423EB44FBE3E579926FC88A054C088357EF94C570ABAF42CEEEA6D3B204848AA4A63D98B5A3723A9C212CDB8
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>...........v...~...................................................................................................................................2...>...f.......v................................I.......I.qk..B.....LZ..........b..)..b.s.....b..)..b.s......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............@X...=...E.y.s.o....N...^...............I.hA.{mO....G{..........f...................................:....I.qk..B.....LZ............@X...=...E.y.s.o........@X...=...E.y.s.o....................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4......................#..............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003C.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:10:32], progressive, precision 8, 594x773, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):242903
                                                                                                                                                              Entropy (8bit):7.944495275553473
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6144:YVxOYlZX2kCWfYoFMXC/sBFC9r+4iEGM4rrcPoWmwkU6FJ:+OwZ2kbFMC/L99ifvokU6/
                                                                                                                                                              MD5:C594A4AA7234EF91E6C2714CFE1410F1
                                                                                                                                                              SHA1:C0F720D4CE3196852814D0B7347F0CAA0C6FD526
                                                                                                                                                              SHA-256:10C833E47BE1C8496F949A6B059C2D79212A4DD66BDE62116EA337FA4FE0B654
                                                                                                                                                              SHA-512:7313F6545A334F9E2DE5430B2DB5C419C4C8A40E075338DAFCD74970BCC6309786946E5DFB57531612BF4C6269495655706D920FD99922FDACFF9796710DA9C0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:10:32.............................R.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................{.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...v&.F;-v;}FH..Z...N..)Y.......h;C....G.0W..ww...MI..Z+..\.........c..4.1.~.Yo.Y6.&. q...............l.A#.~s?yYg..7ky...r

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003D.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.339344067237498
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:Yu+sFvp1uq2t38pd0eEQtbRgqEXMRLLX619qYoJrdQqrbDTcBXiLkQOJDkhkckfY:Yhs/2t3Yd0FQ1ZEXMR/X619qYIRQygS
                                                                                                                                                              MD5:2D4A0609834304FCF39FF6DA91116F24
                                                                                                                                                              SHA1:1C213F3513B99D66BE3A8FD876DC47FE409D8539
                                                                                                                                                              SHA-256:5BDEDCF73599E2F8AF6F871E383B284204F6265534D29BAF9E874D1CB0383C72
                                                                                                                                                              SHA-512:B674D6623963096837BB488D0AA047B0228C2CF59EF2DA94D09BB3A93ADEA7BEBEBDF73A343F938E9F6AD8766DE441BDE9AAFFC69C0A0F7CA264F6669440B01B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZd!......d!...u..0>44..%d!...u..0>44..%d!...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............,f(u...@.;.......N...^...............o..C.=JJ...g.,..........f........................................I.qk..B.....LZ.............,f(u...@.;............,f(u...@.;............d!......d!......d!..........................................d!.j....d!.T.]..d!......d!...B..d!.H....d!...B..d!...>.)d!...J...................;........4...4...4.."..............d!..d!..d!...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........d!......d!.....#d!.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003E.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:12:29], progressive, precision 8, 598x766, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):70028
                                                                                                                                                              Entropy (8bit):7.742089280742944
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:ub4bgbB7g9cKCmSzaNF0jAdAzQKTEFBQqUp/i0yG1pidLHTVX:ub4bIB7Qg2OjbzjgWp/i0yGCZx
                                                                                                                                                              MD5:EC7811912ACA47F6AEB912469761D70D
                                                                                                                                                              SHA1:C759BC2D908705D599B03BDB366C951B11F99A4E
                                                                                                                                                              SHA-256:FBB4573E3BEE1B337077691BEBAE15D6FAC52432405D31396D526D7694A8283D
                                                                                                                                                              SHA-512:881828150993A8C56E36CDA2051D89C1F6E0322643902C9506392C163E8734A2933A46486F40E5BC8C8D0164E180605E52620EF22FE14540AEA787A38B22E98E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....7Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:12:29.............................V.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................}.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....H.yM..? .Z.. .^.x..p.8.A...K.... .\{..)..y....t..=.^y)..v.@.W>. .h.. ..p.:.\)(.$....$.I).....!....E..Z.....&.5.).

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003F.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.345548019030073
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:jOs4FUt2uwQ8zE5VxX7v96++xsRQy7pfMT4yRRPtlmJ:jOs4w2uWgXxX7v963xsRJ7pUT4yRRPt+
                                                                                                                                                              MD5:920B0888A97E07B681C1116AA46DEC5D
                                                                                                                                                              SHA1:92ADC1AA78077748FA088B9B067422B2B893A7AD
                                                                                                                                                              SHA-256:300B2ADB23DCCB4B0938E186495EA0C6BE450331A55BC92C81D4B652E63D2F6A
                                                                                                                                                              SHA-512:808A4FE68A583A9DB9BA500EB620249CB602241C3C4E92FC8A6017577A6DBB3F38BF44B1DF49DF3E7A04F74353D7024C5CC89A123EC6EF71D1A154F1334386A2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ1.......1........TC.G@fh1........TC.G@fh1....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............&...(+x.;...ml2}....N...^.................G...HA..c.m.M........f........................................I.qk..B.....LZ............&...(+x.;...ml2}........&...(+x.;...ml2}.........1.......1.......1...........................................1..j....1..T.]..1.......1....B..1..H....1....B..1....>.)1....J...................;........4...4...4.."..............1...1...1....z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........1.......1......#1..............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003G.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:19:29], progressive, precision 8, 221x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):24268
                                                                                                                                                              Entropy (8bit):6.946124661664625
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:d2wiieoHTRh5a1HAteZCWOZIM+L7WhNjYn:8wHFHJ+/OZIKhNO
                                                                                                                                                              MD5:3CD906D179F59DDFA112510C7E996351
                                                                                                                                                              SHA1:48CDB3685606EDD79D5BCDF0D7267B8B1CCBD5A8
                                                                                                                                                              SHA-256:1591FD26E7FFF5BE97431D0ED3D0ADE5CFC5FA74E3D7EC282FD242160CE68C1F
                                                                                                                                                              SHA-512:2048CBA13AF532FF2BCC7B8B40541993234BD1A8AB6DE47B889AF3F3E4571F9C5A22996D0B1C16DD6603233F6066A1A2A97C16A6020BEDD0826B83BAD0075512
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:19:29.....................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................$.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....)......[]t.\Z..g......A....&D.$LH._..X..Xl...`....cZ.X.........>......f.Z.X...]..~L.S..@..I$..I.IO.....x...s.g.[f.h{9..

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003H.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.320211851323744
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:WsF2RITolmlEhXf9qowRQy3M2RCbCGIxN:WsF2R2osyhXf9qowRJc2ROCGIx
                                                                                                                                                              MD5:7FE9FEDEFE017A7CA637E004117C6C2A
                                                                                                                                                              SHA1:5CB548B9B24627898934F97CE2E7697ED77670DA
                                                                                                                                                              SHA-256:44102AD8608CBC148C4BBC6109310CD3C4B846F3580096BE1B981203F895BF73
                                                                                                                                                              SHA-512:FFC166A1185B26359E8714A4A3F3563A10021D1DE440D15D21DD4D5B7390573CA712F0EC8598753A89BE9E5CDFC08FB2FCE16B9C1F59212A2267E199223A54B0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ*-......*-...@....:D.*..*-...@....:D.*..*-...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................AO...z.........N...^...............?m!...N..5.0.l&........f........................................I.qk..B.....LZ...............AO...z................AO...z..............*-......*-......*-..........................................*-.j....*-.T.]..*-......*-...B..*-.H....*-...B..*-...>.)*-...J...................;........4...4...4.."..............*-..*-..*-...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........*-......*-.....#*-.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003I.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):47294
                                                                                                                                                              Entropy (8bit):7.497888607667405
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:aQ10VrIBdBvDpQrQ7P9/FUOLG2vTSeG9lkCsMKzXeMBk3CBp:aC0JIBL+QsOLG2+ZAC1KqM2I
                                                                                                                                                              MD5:7A450E086AD14BA7D89BA5DB3D3AE6C7
                                                                                                                                                              SHA1:E7AEAFCFCE476390E18C19456BDF6529D863D518
                                                                                                                                                              SHA-256:BDD997068701ED3A00A224EB694B003C01AC69B857FE7B4147D6C34875B1632B
                                                                                                                                                              SHA-512:9B6D50A6CDB6081DA107A2CDDB1BD2811A5764994C8E3F67D56CA81084BE0D068C27435154E867199F38688EA65E8DE02A56DCAC47D0F5E55F0FBB6598814938
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..A..Qa"..q..2.......B#...R%.r...$&b...3Ss.4dU6F.cE..'GC..t..5eufW......................!.1..AQ.aq..".....2BR......r.#3.d...b..Ccs.t......$4T...SD%5Ue&Vf............?..M.7(..).:.a.q.......>..[:O...afQ.uCO..U.....go.l..p..YqVklQ.{i.w&.]Z.\+JQw._.n.'.h..,.bj..X.].k&.Q.>gU..f...1|....[...jQ.%Zb.......t..........*..V..j.6....Vj..i.....?...IY.P.....$.j........[l.....S.4.J9.U\.......7I..[..=*N5....xW..../...=?n....uG.D..S.>...8..3........n.S....]k.*...4.>.R.o..{..l.H.#.^....<amG.m&.......,....wDY.W.m.X....We.IR.Nu...y..Z.l.._S.mr.m...y.]m.R.MT...6.5.5}.K..#%..k].7.Y.q]...%.r.7.R^jR..z.K.T[t.a..d.)glW.r.v,.`....O..^..o:.Uc.\..D....f..D......yt.Q...Y.....

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003J.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.464632966940678
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:eTsKMt6+0oEw4X29ye0RQykjTwh6TAf8:Usl6+uw4X29ye0RJk
                                                                                                                                                              MD5:A067444876272328B1DB0B5DBB191B8D
                                                                                                                                                              SHA1:6AE4BECAFEF62642BF9139EFDE2F95635B65FBA5
                                                                                                                                                              SHA-256:4A0ABE729DE9FBDA0027BF0AD6FE4F73343F06BAB1802C1A78B28A1C19AB622E
                                                                                                                                                              SHA-512:1A9AEA95243D3A62246F9406CDB66054EFCE97349F7DF06F3A800C437CD75013B5E2DDEAA5DF6E50C7130BEB1A0CE43BF5338F2D9CA94218CFC60FE0738C2EDE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......n...v...b...................................................................................................................................2...>...J.......v................................I.......I.qk..B.....LZ.)Q......)Q...j.......k..)Q...j.......k..)Q..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............pm{...E,.i?.5....N...^.................p+...D...z/8. ........f........................................I.qk..B.....LZ..............pm{...E,.i?.5..........pm{...E,.i?.5..........)Q......)Q......)Q..........................................)Qj.....)QT.]...)Q......)Q..B...)QH.....)Q..B...)Q..>.).)Q..J...................;........4...4...4.."...............)Q..)Q..)Q..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........)Q......)Q....#.)Q............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003K.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 60 x 336, 4-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):347
                                                                                                                                                              Entropy (8bit):6.85024426015615
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:6v/lhPtnlx/QulkWNY2V18A6Akp7eee1VDjMHCyLezyKUX5Gp:6v/7RrIubiA6AkpNhiyKe+
                                                                                                                                                              MD5:78762C169F8B104CB57DFF5A1669D2DF
                                                                                                                                                              SHA1:9638B71B584CD636834016A635ABF8D9C0887711
                                                                                                                                                              SHA-256:E64FDCD0B108737D8B8F7B677029F924031D6BBAA50585D9C3DEF7C7E92ECAF2
                                                                                                                                                              SHA-512:5ED899AAF73B72DEC32E171FFA112382667D5BF3FBA98C92E313E66C0A6975EA97068F4CD32B62283F18DBD5345C11E3610F7EEAC2F2DE71FC44593180B9CEAC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...<...P.............PLTE......................=l......bKGD....H....cmPPJCmp0712....Om......IDATh......@..aI...B..C..l...^.%.`....>.]..|0.....a...hb...0......q.......p"....;...K..x=...p...y.yy~J....|...\.......y..X.......'...>1...Ky..f....&........N`..f0..b...3.......`Z.3..3.....o.......4.&........SV...4.....IEND.B`.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003L.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.350798585539876
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:k7seMJkj6HJ/XEJXY9+iMRQy8dcJgF8er:8seMJkj6p/0JXY9+iMRJscJgF8e
                                                                                                                                                              MD5:8355163E42434A7FBDA55219772FBA25
                                                                                                                                                              SHA1:A6DB43D3B88268F90E2DBB0C4326DC9532BA22B4
                                                                                                                                                              SHA-256:D7C460342F321E20735353AF2ECA5D3E927C076016B3E3AD08E8D6D2FF115C02
                                                                                                                                                              SHA-512:28173A6829679BC0211AD885B56E18DF56CCC19B2E604A15356F58A74BB3B7F26ABA16FA6ACE11A3D7B362E4A88A1615067F3655DBF185CB65A6A27F648686EA
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z....................................Co.z....<k....I.......I.qk..B.....LZ..Co.z....<k.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............{.f... ,.Gy=C.....N...^................i...C.E................f........................................I.qk..B.....LZ..............{.f... ,.Gy=C...........{.f... ,.Gy=C.....................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4......................#..............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003M.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 40 x 617, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):827
                                                                                                                                                              Entropy (8bit):7.23139555596658
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:6v/7Hs2NwBW1mtjeSfaTHHy05riYUtr8y8PQvPYzzg979Reip0QPqc:oOsotazy4rStr8y8PQIzWea0Qv
                                                                                                                                                              MD5:3E675D61F588462FB452342B14BCF9C0
                                                                                                                                                              SHA1:86B62019BC3C5BE48B654256B5D10293FC8C842A
                                                                                                                                                              SHA-256:639EADAD468B6B32B9124B1F4395A8DA3027FF7258D102173BA070AE2ED541AE
                                                                                                                                                              SHA-512:E6EA855B642ED36FA82F8E469A826DC57EB0C36E307045FF8D166F67AF9242C87840833BE31FBE4706DC54100E999D6A3D3A78D0633A3114735818874AD34758
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...(...i..........`PLTE...................................................................................................bKGD....H....cmPPJCmp0712....H.s....qIDATx^...0.Cg.;......@j..2c.=~KP.[H~..@..8...?U.g.n.a=.=.).....3..u^(.....L....5..........8.}..T.f.n.a=.=.).....3..u^(.....L..r....s..8.....W]....,..9..G?.a..`c.z...E.p...)Y.P.....#....@9.7].....,..9..G?.a..`c.z...E.p...)Y.P...`b....0.b.+~{.Pu...1..<..0._.l.@O.y.(...V3%..J....s... .(g.+.qyWu...1..<..0._.l.@O.y.(...V3%...%R.L.Q..x..R.<t.o......7.............:/.E..j.da@i..`b..Z......u.>.?...7.............:/.E..j.da@.Dj..9.W....s. .....:.......L...">w..7... .....:..."...L..."..a....D..Ya.l....E.{.@&.|.._...7..D..Ya.l.....{.@&.|....0.J.."z.0s..s....=g ..>........"z.0s..s....=g ..>..l..1...y..g......IEND.B`.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003N.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.350124662365629
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:isHbefoTtGJ5ESEX24LPXn9a4orlrdQqrsFQBBX6ViDhoK6:isEoT6REXn7Xn9a4ulRQysOBfo
                                                                                                                                                              MD5:61B43C47604D0010FCF988804EA4779E
                                                                                                                                                              SHA1:F098EAF296650D8B5ABD7E95E390E954BED0C518
                                                                                                                                                              SHA-256:D7F8E1EDBD957F35EB9E0B9B19F1CF9A6ABA848C9D897AE3EE63063A5D73171D
                                                                                                                                                              SHA-512:F50C444095EE9723D0D5AC7654AE28E93F23BFD65F0399790C3EC0A8FFACD9F3E035F33A189A62FCD378AB5EA02D5488AB2637C4A204E192BFDF19C903D047FD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.1.......1.[.3.2l....y.1.[.3.2l....y.1...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............K......$.t..E.....N...^...............,[.....I..,.^.O........f........................................I.qk..B.....LZ............K......$.t..E.........K......$.t..E...........1.......1.......1...........................................1.j.....1.T.]...1.......1...B...1.H.....1...B...1...>.).1...J...................;........4...4...4.."...............1...1...1...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........1.......1.....#.1.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003O.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 50 x 600, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4410
                                                                                                                                                              Entropy (8bit):7.857636973514526
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:E/pQuIhKZ7u06dICH3AroiTe8DGTl55poBUmLNjpH7MvDHjfm:MpdZtPbknnRPpkLNVMvu
                                                                                                                                                              MD5:2494381A1ACDC83843B912CFCDE5643B
                                                                                                                                                              SHA1:98F9D1CC140076D1AE5A9EA19F47658FD5DF0D66
                                                                                                                                                              SHA-256:5EEBE803E434A845D19BC600DF3C75E98BB69BD0DE473CEEC410D1B3A9154E28
                                                                                                                                                              SHA-512:0E64CC3723DC41D94910F7ADFB6A0DFB5049350FD15A873695614E4A89ABD78B166BA4E9C8CB95E275FB56981539DECD2A7F28FBC25E80DD5E2DEA8077CC9489
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...2...X.......E.....PLTE...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................B..(....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.].\TU.?3"...(..L........q.Q...H.*j......W..Xd.ie.f..%.XT...em..m.m.vkik...>.}..}|..{'.U..~......}....s.............,CVu.x.:C..5...;.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003P.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.322608657520438
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:Yu9Us7O9e0zeltWxI/EZUncf0LTKXBkzrNK9yYFoFrdQqrRVABXwapuf71ipOTIG:YlsozelV/EZnf03KX4xK9y+kRQy0w
                                                                                                                                                              MD5:C82A6D925DC828B0E561C18E8E353713
                                                                                                                                                              SHA1:04BA3480BD807B3ED933D5F11FE30512409CA252
                                                                                                                                                              SHA-256:6BFFF74EAD621555EC1C32E76FD4D48CD7924A099F3ECD5412F0EF5F13FD3A2F
                                                                                                                                                              SHA-512:6FE93B58D5EEFF836DA7B2365817F3C01A48F525BE652281BEFB3C4A3589339E338EA43C7EFB845EE7E9C841C420BE82227693DE05C4D0894FBDA96C83D50486
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ.V......V......D...PD..V......D...PD..V..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................!....O.......N...^.....................VO...B.S..........f........................................I.qk..B.....LZ...............!....O..............!....O.............V......V......V..........................................Vj.....VT.]...V......V..B...VH.....V..B...V..>.).V..J...................;........4...4...4.."...............V..V..V..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........V......V....#.V............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003Q.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):136726
                                                                                                                                                              Entropy (8bit):7.973487854173386
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:SIXmy5Tl704vW2ZKkvV8UU0ZWUF0BJwySIdgz816YzDc1+opecYPn:Sny5Tl704fZFV8UU6LGXwyS4xohpQPn
                                                                                                                                                              MD5:4A2472AC2A9434E35701362D1C56EDDF
                                                                                                                                                              SHA1:16FA2EA2D2808D75445896E03B67A93000EEDDD8
                                                                                                                                                              SHA-256:505F731CB7707EFAB2EB06685B392DC7E59265A40B55AAE43E5DC15C0A86CBA4
                                                                                                                                                              SHA-512:5E28D8FB2AC62ED270968072A30013334461F7CAE96058AF9EAA6E10912989DC47112D2133892BF61F7A516B77C6FF71BA2A000B750A9F95C787E538B09595C2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQaq".....2B....R#..b3...r...C$...X.....Sc...9.%'.(Hs4Dgw..T..5GW.x.)......................!.1..AQa"2.q.......B..#c........b6.Rr.3s$.&..S...C4.%5............?.........(......(......(......(......(......(......(......(.G/.GE&...)..P.x..B.({i2Y;.z?G...Yfc.)H..^....#.....}3..Sc^.H..+...M.a.P.....GS.....H_.3..<....1f........1.<.\..nn-..s.s.\9Y....=.......S.0.......N..cA..Io..r.3..........ay.....K.....,.;9..Q......xO.Fa.2..>........{4k.....|....?U....3.8..._/3....#.. t.y......yY.......e.<........#.....B.....Z.%.Y..S.ye.W4...l.......X...%.@y}>....l.yi..D..W......L..._D.Q....)...E....n.%...*..K.4#.8`..I....h..h.o..I......-...hB...3..u.(5..........n...,.@....a.t.9.....@.s.>.&...@

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003R.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.3304472737872945
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:nDisP02YWY076QtNAjEKHL/1XLf9/q2dol7rdQqrWIw0BXFC9j9LJN:ese076QUEKHxXLf9/qG8RQyvw0TCd
                                                                                                                                                              MD5:7D63445C61641C68029973C46A634697
                                                                                                                                                              SHA1:46F054B9A7F339F4855FD2A7C433912A610C3BA4
                                                                                                                                                              SHA-256:34591E241CEC1B13D927EAE12617630E3FA83B8FBF2D0A355C920EE413EA7527
                                                                                                                                                              SHA-512:F8F1160CB357E4E4B993E7C2DFFB94366DE213886D3078D9A9B3CDB53A71B177519FAFD34FD646C4DD860838F5490DA98210693B5990EF93B276178BDC4B1EA5
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ...........Y.*.".r.e....Y.*.".r.e......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............1.8X....$.E.......N...^...............{%u...G.5.Np.}.........f........................................I.qk..B.....LZ.............1.8X....$.E............1.8X....$.E...........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003S.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 77 x 627, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):5136
                                                                                                                                                              Entropy (8bit):7.622045262603241
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:djzuNKb3XHco17p2wolIxIx7lpskdsC/ddWNKeabJbMojpxLDTu1:VzuNKb397pwlIxKp7qs3bJb5FBTw
                                                                                                                                                              MD5:FA38AFA965141EA3F17863EE8DCCDE61
                                                                                                                                                              SHA1:2B4611E651AF7549C1AA73932B1136B561A7602F
                                                                                                                                                              SHA-256:E1CB1A0EC9BE62D5445C73AA84DF38234002A7E164EE830C9DF24997802CB5D2
                                                                                                                                                              SHA-512:A372674F5CA343321BA9C413D346070709F7685706C9C6C3DC7F61846B59253A5E6FE800DBA10AE870FD3887439B2AA106FBBB51751E92A163938A4393C43E28
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...M...s.....}8nv....PLTE.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................z`.....tRNS...................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003T.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.452246894021779
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:zW6stW0e2atS/sEBvZXkHR9G6otrdQqraYBXsA2nYq/t:hs5e2aVERZXkHR9G6MRQy/h/6
                                                                                                                                                              MD5:5540DC162E81EEA419C811847C28AA0D
                                                                                                                                                              SHA1:D8C08727E3DD25501823ABC7640DF970AD4A72FA
                                                                                                                                                              SHA-256:3BCA69D48BB80E2FC228C30FFAEF4A6ADC5C9E799BAD8F5D699ED2B742136A8C
                                                                                                                                                              SHA-512:63E84ED042B23618746D4224E6FF0C244336F52E746271ED1C6BED9CF4721B15A983F6E0202D992C23F5B34AA977497D231EA69942C3B94382CD72699451B113
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......h...v...\...................................................................................................................................2...>...D.......v................................I.......I.qk..B.....LZ..g.......g.....&....2....g.....&....2....g..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.....................t.tL`<....N...^......................C..c.$..j........f........................................I.qk..B.....LZ....................t.tL`<................t.tL`<...........g.......g.......g...........................................gj......gT.]....g.......g..B....gH......g..B....g..>.)..g..J...................;........4...4...4.."................g...g...g..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4...........g.......g....#..g............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003U.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):52945
                                                                                                                                                              Entropy (8bit):7.6490972666456765
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:cjvqR0XvFaGCTJffi0tgybmWDoTw71kHUAnjvawrlp2+NUO8dWSNl3PF2PjK/q09:cyRffflgybmWoTw1UUADHUbU21MjpAD
                                                                                                                                                              MD5:AD003F032F32FAC4672D4CE237FA5C5B
                                                                                                                                                              SHA1:AE234931B452F0D649D91291763B919CF350EA49
                                                                                                                                                              SHA-256:ADB1EBBE18D6CD8FF08AA9BF5C83CDB83BF9AA179698E34E93DBCDDE12F04D32
                                                                                                                                                              SHA-512:ECA25FA657ECE3A66D3E650628E0F65D3BADD38864C028AB6553950A1A66D7D55482C85E9E565573E9E5AAFA91C2D53235971C644A266D41EB69F8E72E3A843B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQ..aq....".....2....BR#r.b3$...C.Sc%...s5E......................!1.A..Q.aq"...2...#...B...Rb3..$..CSr...6............?......y_N.e.H7?........W..w....k|...S..d.4.>.RW5z.$.i.)V.O....>o...c..*&1.D..O..".ufbb..1...t..u=..K...m...~.....F..-.fb:i..=f..C.w.[{..~.7k....;..:..3....4.....$..m]...}....~q...9T.#..7.~..8...q.N;c..ffo.w...W..d........../t_........lWJE..).>..v;:=....Rrw#.m.n.n...E...vm.J}2N*..|.4...80.#..e....t.J..ZQ.x|g/....F..e....k+vK...M..W.X.e.L..~...j.....kz....=...n:O.:..[.L,.+R...Y..zKNI....,..{e..U.'...}.......|..t.]...~...b4......_.i..../.......m...a..n...v.j.?..Rc.$G|.31..#..$?.........h.w....-... .a.%z..u......u.A....Fm..J.......G..[...w.....:....w/.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003V.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.430694736286397
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:zWd4sv7X6Q6owtAyuKEbL+XXQXyaN99Z8P3ZrdqrbUb9cSQ6BX6Dgt2wXkh:g4sO7owV5EbxXyaX9Z8PJRyopc+asu
                                                                                                                                                              MD5:36281482CD00FC78C02D16FBB3AD3ED6
                                                                                                                                                              SHA1:A78889586CDB3CDF26772D3E29E374FD6A099AD5
                                                                                                                                                              SHA-256:C8A4D1C8B4B87BE815918EAC4208EA959EC96A928B16889803D38579D043C7C2
                                                                                                                                                              SHA-512:EAF2914783487B456BEB096B1FE9D5B6C098732EEE45BFC092F1EFFCB336A977700EE4C1A33F162D8833D430180B82E1F3ED02A52945A60E529165A68B6A1436
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......h...v...\...................................................................................................................................2...>...D.......v................................I.......I.qk..B.....LZ..&.......&c..n...i..p.(..&c..n...i..p.(..&..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............;t...%.!.......N...^...............'.V...$L.o.............f........................................I.qk..B.....LZ..............;t...%.!.............;t...%.!..............&.......&.......&...........................................&j......&T.]....&.......&..B....&H......&..B....&..>.)..&..J...................;........4...4...4.."................&...&...&..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4...........&.......&....#..&............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000040.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):79656
                                                                                                                                                              Entropy (8bit):7.966459570826366
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:2kuUliOeU4os8ii3nF3Hxro/qxXD9u/kjYgMZqoEs6ZUldm:3uUsOXYIAixR2k7WAZV
                                                                                                                                                              MD5:39FF3ACAE544EAC172B1269F825B9E9F
                                                                                                                                                              SHA1:2D40DE8D90BD21D56314D3F99CEF4FBAE3712C0F
                                                                                                                                                              SHA-256:70475431CCA3C91A4EFA3B8F04864371D2D3A45696674A1A0562FE9CD8DB287C
                                                                                                                                                              SHA-512:3B9F3B32696AB7779864E83DC0C45960114A130BEE0CF4D0643DE57FF952171E5D775AA49141EE31A28A9B5D052B26EB421F26EA736D7EF4B3A7EC812CA411CB
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!.1A.Qa"..q.....2#..BRb..r3$.Cc..Ss.4...D%5&..T...'7....................!1.A..Q.aq..."2.....B3.r.#..R...bc$4..D.s%............?..Y..T.o.\......=.a..j..'^..s..[../........Y.......<...(..4.....7y..Ln.[9.cK.ilN...u@$.V.9.V?3..s.KL.z..w.jW.C.............@.~+.o?o8...k....,.m..9.".....q.....d....z.W...q...~...'..e..>..f#...S.....F....pU.......7..N.vfK......S..G.#.....}.c.........RXt.bq1.`.....[+8\.*.N..:......}.....r..........')......Na...&...m......c...a4_%d.............co..0.n.L.Q..E.Lt..y.|..F..4.i(>.._..\.eNL8..?z9I:hLgC.@.p....g.t......'.I!d..?1f..R..........|..4.wJ*..%g..~0bt.....*...v.......O...:.~.>~..o.x...9.@>...s.&.E.0/G.c..t.<..F.t.A.z. ......;.........Gp.P

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000041.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.470229942961725
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:8sOp8P6K7D+tcd4EWnNql1Xxi9XFoLZrdqr24GhzFRXwM4VfHtn:8sjP6K7D+SuEHXxi9XF+ZRy244JUH
                                                                                                                                                              MD5:03DA28BB68A1D1EC78A32D4D4F1DAFB8
                                                                                                                                                              SHA1:907EE3E101FC449C54EE68A6FA16822FB09A4C4F
                                                                                                                                                              SHA-256:A4A270BB862D1221C8682B3B1626DDE306E3E3BA4ED250B1B8AD582A7C1979D0
                                                                                                                                                              SHA-512:70217CED3C3597A4406819CDED74A635E12DBC713E477706E40CE35C798AB00CA83F3770A4C44233E5DFA6F3B566B06D17510771A7560731DB0B9E79F31474D3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......p...v...d.....................................................?....?........................................................................2...>...L.......v................................I.......I.qk..B.....LZ...........b....g........b....g........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.......................0+.......N...^...............y...9..F..f...J.........f................................... ....I.qk..B.....LZ......................0+.....................0+.......................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4......................#..............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000042.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):40884
                                                                                                                                                              Entropy (8bit):7.545929039957292
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:MCBOA4d+ElOXJ/3pI7cRBiL7L6qERqGz65WXzZqJsKQSbIsTT6XB:hIAU+2cGdLX6qBG4WDZl4Ihx
                                                                                                                                                              MD5:7379775A1E2AB7FAB95CFFCE01AE05F3
                                                                                                                                                              SHA1:3D3DDFD8AC7E07203561BAE423D66F0806833AB3
                                                                                                                                                              SHA-256:9301DB6D2D87282FCEE450189AEACE16D85F64273BF62713A3044992B6B7A9E9
                                                                                                                                                              SHA-512:4B5006E620E80D3A146944649CF4CA619782CAD7E8C4CD0D1DE0EBCA0FA05EACB7378DAFCEED3E26F5698B07F19604614D906C8F51F898660E2F129D8DEC6F62
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1A.....Qaq....".....2....BR#S..br...3T...C$.7(Hx....4D.G..Xh.cs..'..t...%...8.....................1...!AQ..a...q"2.4Tt.......R3S....Br...#s...Uu.bc.de..$D..6..C%E..............?...z...;sB.yv...........]t.\...n...../....m....M.=.3G+..x+.....S).*&.J../..8..O/+..sG...p...<!....~.c..C.w..,[oHom.wc-.J.~.......L[..6...'..i_..S;...!Y.z.q].EK..M.x...i.x.+.;.+...}....#......f.)........e6V..p.;........s.)..Ml.J......IU.6...<9+9.^..l..Y...[._...2..^..j.ia...._..3.;...~..<3...;......z.^.......]..Qk.,...Yk...3.3Jy^p.}....q...I...&..t.......;..9.g.GH;..'...%...)..[..y..../...zCn..>...'...1e.Y..;....]..7...N>t..m-.j.............H^..T\.q.ru...}...eTn]I'r.^].#..wOY....v

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000043.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.337025580747541
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:YlszanFGwP++En+jXk9zwgRyVC4FuCWVaTK:mszanFGwP++jXk9zwgRyM4FuCWVa
                                                                                                                                                              MD5:B31C45F207674D1E48DB4C864906580D
                                                                                                                                                              SHA1:7637084E65C0314B12B18D7367300B3B74437341
                                                                                                                                                              SHA-256:1C2A498DF26BB3F36FE9437B2C90390B4FE00E8FDD6DD943DCFE72EF319366BE
                                                                                                                                                              SHA-512:B8DEC0E7AE4F6017F9972418D054A0BF69D7C2959A925653052204025212223BCA307828CF8020BAB38E3844BCD9ABF05658C5BB4CAC9F70B0D59433378C11C1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ............3............3.............I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............h..1r..7",.......N...^.....................<A....... ........f........................................I.qk..B.....LZ............h..1r..7",...........h..1r..7",...........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000044.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:05:55], progressive, precision 8, 612x618, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):68633
                                                                                                                                                              Entropy (8bit):7.709776384921022
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:tapXpSTJDOkFGdJdBk/slsbfsw1imaapnbvD8:U2OjJr6b07m1bvD8
                                                                                                                                                              MD5:41241EE59AB7BC9EB34784E3BCE31CB4
                                                                                                                                                              SHA1:98680761A51E9199CF3C89F68B5309FBEC7EE3CB
                                                                                                                                                              SHA-256:035B26DF61855A3F36DBD30FDAB0C157C04C9E8AE2197EA4D4AEB3E82E6A4C2B
                                                                                                                                                              SHA-512:3EE331D5BCEE4AD5D3FC9661D4AB4053F7D351591A094334F963C33C9D0E32CCCABE9334AD7C308108CE99617E064FE848DCD469ACD8D83FBE5C4452DE523D8F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:05:55.............................d...........j...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?../$.W:SZ./...9.....-...u......r.....].c...@W_.7...+......v.+PD.I..-<1.pDn-\.....p.$....0.}V....\..>.~..XN.o..l(E....ik..o.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000045.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.429238303850009
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:5Gshvl3phWDEg3emXJX5W9T36oRy7ca+fZw:5GsNdpTg3emXJX09TKoRyGf
                                                                                                                                                              MD5:F092A35E28519E651BA97152E437879B
                                                                                                                                                              SHA1:90BB1D71C413D3E8EE5D1CDE906CDB1A66E3F7B8
                                                                                                                                                              SHA-256:B9DD1632CD7A0697C491AEBA5EF781E34FB253A60211270210E5A8D987310D5F
                                                                                                                                                              SHA-512:42E81E557E39B2DF5DAF54AA0E87DDF55B46652059FBE79CC400698D20999A31204EF47D241DC7C375BC1D7BC910B3517DC35A639D38007AC6E2F01F56D7C629
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......t...v...h...................................................................................................................................2...>...P.......v................................I.......I.qk..B.....LZn;......n;...R.*J..G..%n;...R.*J..G..%n;...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............cS.. ...@nsQ.......N...^.................s=0.yO......I.........f...................................$....I.qk..B.....LZ............cS.. ...@nsQ...........cS.. ...@nsQ............n;......n;......n;..........................................n;.j....n;.T.]..n;......n;..B..n;.H....n;...B..n;...>.)n;...J...................;........4...4...4.."..............n;..n;..n;...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........n;......n;.....#n;.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000046.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 176 x 513, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):11043
                                                                                                                                                              Entropy (8bit):7.96811228801767
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:YyroOCsBI9pkCFsHHX2RE6VOlPuIqmBtJNBfAr+ADP1IATaNeTyZ4GF+WQQ6Qwq2:BUOCsB2kCGH32RiPDtDBfArPDP1I/eyM
                                                                                                                                                              MD5:8E9AB9C28B155A66BC5C0DA5E2A4EFB5
                                                                                                                                                              SHA1:972E61F162D48F1CEE21963ECBB2FE439105DB55
                                                                                                                                                              SHA-256:B243A24FA13BC8523450E22F408F9EFF15301C938F8CA52A57018B58CE6785DE
                                                                                                                                                              SHA-512:12062D69E676B3B34AFCEF25AC17B40294282D5BAB6C0110680293D7CC96EC17EBCFE104C284E64A30EE3C483E319E9C37C03F6EE82C79632180E45C7A684E8C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR..............`....`PLTE............................................................................................... .......bKGD....H....cmPPJCmp0712....H.s...*YIDATx^.]...,.N.8.i......0..e..y.......8.6....Fo.........=...F..._..........O..{..............3.|.L.|.............>.....v..n.1J...k...."....7........J._.5LQ`..k...._Z.W.x:..k...g..._.....u<.Q{...1...q6.cs...l............30.g...< W...a.5..>O....9}..c..........s|I.).>.fo4.<q......>...c.:.u..co.#.7,.O..G./.K.|..q.p...(.(....iH.......m..+.7...../..{W.l....b....?.`^.q.9L&.>.hN2`1..m...]$.0J....rBy......{.._...G....;.r.Q..;..,...9..F...t;.+..2.Ub......V...8.k..5.........'[..s.H..).......%j._.&.....BN..V..q...T...#..........0.E&.o7....$..m..8g.f._$..k.8...5......HgQ...L..\.........)B.I.r.(..8.a..$N.9.=..o..Q..(.e.a..O.....c.= .......$0..X.S,..(p......$..l.c.I...=."......g....^..#~,&.a9iK..ZNE`...pFJ.@Wd?.<..Bt.E.......e...i.%d...}.!..B......9.........B}.....5...;..hL.D.....4z.....|.)

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000047.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.349062499884562
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:osHM9MlLGGEQyX/Jm9jL0ZKRyEYFrBdYF4JO:osHM9MlLWQyXRm9j4oRyEYFtdYFSO
                                                                                                                                                              MD5:D15643E1FC72F8EF0BDCFA51633FDE9E
                                                                                                                                                              SHA1:71311DBFE2CF697D752F7BE43E76578B27A2BDBB
                                                                                                                                                              SHA-256:F7A031ACF39000C7794097796C1F55C694A213EA14BEA60109ED23CA4993AA74
                                                                                                                                                              SHA-512:86DC09CC40BE5EA038DDF2DC2E2FFDE83C864F127409F017480F8A34B33B1A97390B3DC8FE4260B63A4A6FC136BDBC47D7E629D4155F1C3E1A5A74AB31807363
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.|.......|...I@...l...u..|...I@...l...u..|...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............b..-#...)..f........N...^..................za..D..L..i..........f........................................I.qk..B.....LZ............b..-#...)..f............b..-#...)..f..............|.......|.......|...........................................|.j.....|.T.]...|.......|...B...|.H.....|...B...|...>.).|...J...................;........4...4...4.."...............|...|...|...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4..........|.......|.....#.|.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000048.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 40 x 650, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):647
                                                                                                                                                              Entropy (8bit):6.854433034679255
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:6v/71rwqZMXVs99W1YvpLp/Fvl+f43ocLtuplb+CrGotLRd:+wqWXVs99rpLpNvr3pIx3b
                                                                                                                                                              MD5:DD876AA103BEC3AC83C769D768AD39FB
                                                                                                                                                              SHA1:1833603AA9B6A7E53F9AD8A336F96CCE33088234
                                                                                                                                                              SHA-256:1262DD23AD54E935CFA10FEB1BE56648E43BEF1116696CA71D87E6E033B1CA7D
                                                                                                                                                              SHA-512:946DB2277213104A3B29EC4388578B05027B974A3093B4CCAD8847397AA51AE308BC6A199E5705E1F901D6E4B1BA34D8DECFD6E5B6685184A307D749D7CFAEDD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...(.........xk....`PLTE.........................................................................................>.S.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.)..1..7w....6.*.H`T6.ha.k.............b!....Ba..C..P.4K..@.....h.E..X....PX+.P.-.....@@"...o.O4....xZ<...B...B..,A..y.s<......b!....Ba..C..0_p. .......=..,...i. ...=.j..N...........{4+...xZ<...B....|.....$.K<.vyE..X....PX+.P.-.:... .'p......\,...i. ...=.j........K.....%J..S+.....q..k.H.@DD.s...:..J.K.DDL.\.@`,.DD.:.(]..N....KD....A M.....F..S+.....1.sq........\.t..;..../...~k...4.DD.:..]..N....KD........@DD.s...:..J.K..[...Q....V......IEND.B`.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000049.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.361825077362833
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:ysJEyEx28b+PmEjFFpXbfp9Tg4RyK9dqey7jXxQY:ysJEyE7ixLXt9Tg4RyK9dqey7jXx
                                                                                                                                                              MD5:58CE3D6814AEC284F313249169D007F2
                                                                                                                                                              SHA1:0296B9253977897DF277D2BADF06B41F72303AEF
                                                                                                                                                              SHA-256:CB9406A38578E8723D4152ACD660EB86345C89DE2EE7CA40FE68442E87AD2422
                                                                                                                                                              SHA-512:D7B7FECEE954DFB18E7F120F3E8606F052EA96DA1B77C609933FD06321E0936C699C0BFC5A46DBF8F8A0553BE3CA3DD0C906BA08C4818813F1C989A308406784
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ.d.......d...M:........d...M:........d...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............+sx-1......(.%....N...^................<..a.RH.....o..........f........................................I.qk..B.....LZ..............+sx-1......(.%..........+sx-1......(.%..........d.......d.......d...........................................d.j.....d.T.]...d.......d...B...d.H.....d...B...d...>.).d...J...................;........4...4...4.."...............d...d...d...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4..........d.......d.....#.d.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004A.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:27:10], progressive, precision 8, 102x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):52912
                                                                                                                                                              Entropy (8bit):7.679147474806877
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:DB/nIviNJD9C8kfJj6TkVr4q24FsUpjPc021si:DdnIvi3D9C8Cl6Dq24ayPCz
                                                                                                                                                              MD5:1122BF4C2A42B4FA7F29D3C94954A7C9
                                                                                                                                                              SHA1:3750077A830FE21735A43ABD35C63BA9A4D4B0DE
                                                                                                                                                              SHA-256:423B0DD1A93B391D15B1DC8D8757C3BF5725FF2E7A59E6E3140033E2876B67F6
                                                                                                                                                              SHA-512:4626EFE2EDED2361D6296B57F994DC434CC9D02357A8A6A67D84A544FB8A1CFE0005EA98F846AB963BED7F2B6CE96BC9181182C9459843A52A98D3A731A4FE73
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:27:10............................f.........................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....]+\.9.9.P.d..Z.?~>.-...]6=....*.......S.9G...b<$..Z..........>.v.o:.o%.e...z.F`...[.wo..z.....k..E...5....G..7.......c2..

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004B.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.340010488845736
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:mBs4PDK/MjmTDzjt3Ko32QEkYrVBXnH9TAoRrdqrPDKRXfJEMj1ZwuuAgdDYV:mBslzjVYQEkSLXH9TAARyOjtF
                                                                                                                                                              MD5:F08FD5087F2368B5F80C0F786FAA3AF4
                                                                                                                                                              SHA1:E5DA9F7E99C8FA5904AA173D89D57DAAECF1A8BB
                                                                                                                                                              SHA-256:EF238D5BC1C523E899501010BC1280E877D11B960E768E366CB9F3E2C08E77D0
                                                                                                                                                              SHA-512:620ED3FA60440E306BB234F5E703F4C4FDE7DEC31FFF67432E682127876DA887F25641519E2CF7CAF5F04F36A43F8FFF34B45DAE2E607FC47D41E94B7C621A01
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.X;......X;.h...3.h...J.X;.h...3.h...J.X;..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............LA;EY.+.i.........N...^.................Z.y.SB.|=....i........f........................................I.qk..B.....LZ.............LA;EY.+.i..............LA;EY.+.i...............X;......X;......X;..........................................X;j.....X;T.]...X;......X;..B...X;H.....X;..B...X;..>.).X;..J...................;........4...4...4.."...............X;..X;..X;..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4..........X;......X;....#.X;............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004C.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:18:09], progressive, precision 8, 164x641, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):27862
                                                                                                                                                              Entropy (8bit):7.238903610770013
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:LTawAZvhbrXzDc6LERLQ/b5vXOl6pXQ/wD5OUMrdRUUhCplQg0ESSz:6wm/vT/b4wxoqbdUhWnSs
                                                                                                                                                              MD5:E62F2908FA5F7189ED8EEBD413928DEE
                                                                                                                                                              SHA1:CA249B4A70924B73BDA52972E9C735AEC35A0C5D
                                                                                                                                                              SHA-256:20ABE389C885E42B6EBE9E902976229BB6FD63C8C34CB61AA70B8B746209F90A
                                                                                                                                                              SHA-512:EE8D1821A918BE8714F431895E7223D08036E88A4FDB9A5485EFF246640EE969A69A8AA4E2E9DDC35BA75FB6D4E95092A286E90B477BD6998C313639C2C31F25
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:18:09......................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................!.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..P.v..+..n(a..Q..S\6....Y....D......} w#.b..]l.5.RU..k...... ]$.$.........f........?.z@2uU...7....?..|.Q..I.&.. ......"T4)wdH.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004D.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.501049433601254
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:DiBsA12VYMtbYaJE5z4muXrf9XqoRrdqrfbPZRX9GNEitJV:DiBsfV5FE5smuXrf9XqARydE
                                                                                                                                                              MD5:2FDC085427209A86309B4B92CCE01F76
                                                                                                                                                              SHA1:B33105B41A9E19153F42B87EC801EEAEF4A79A7C
                                                                                                                                                              SHA-256:9BFC40BB2BC0CDF0ED9CF8920D578B0747B2ED56F7C1F45E5295B21D52E4AD6F
                                                                                                                                                              SHA-512:AC170F5952609EA6574EFF5AF27EB62D15AC57636CDBE9526B2661E7DE30FEB682FF4E51B47C6241706773FAE564692D004E199E9CA0265C49354AD90B46D8B9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......r...v...f...................................................................................................................................2...>...N.......v................................I.......I.qk..B.....LZ.P.......P.9....am.w.7..P.9....am.w.7..P...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............V.../.W../......N...^...............},....oA.....o.........f..................................."....I.qk..B.....LZ..............V.../.W../............V.../.W../............P.......P.......P...........................................P.j.....P.T.]...P.......P..B...P.H.....P...B...P...>.).P...J...................;........4...4...4.."...............P...P...P...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4..........P.......P.....#.P.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004E.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 50 x 556, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):977
                                                                                                                                                              Entropy (8bit):7.231269197132181
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:6v/7QiFJaY/z+obuqFA4fypjQSbtBK+lcqNGSbb7XTJArRRzN5DjNRkPmu5cCbR2:x0QY7xbjy9pY0JPXLTWroeuCCbX0
                                                                                                                                                              MD5:B7F74C18002A81A578A4EE60C407A8D3
                                                                                                                                                              SHA1:70A7D4BB1B3ADF4397D168AD0D81B286F88EBDE0
                                                                                                                                                              SHA-256:95F59A0433050180D4C0E8858B83363D51BEA6752A8B7CA516A8677854D8F5B6
                                                                                                                                                              SHA-512:13186A7CDCE80BCA9D2238666D6D7A989FA1887EABFA5D8A9A63EEC304DFD4BE8EFF652205FA56E1D1CEE7D3680AF8C70A952AF73AB3C246400E8D4EBECBDBA9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...2...,........A....PLTE...................................................................................................................................................................................$.y.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^...0.D_.......cck.....%a...X.a0Y...-..!.G...[....(.r.H.$...1 .zq.4V.e|a.6.X..4..kl.%....=w....6..TN.....{.4..T/.z...../.....3..!~..t.#b..^.....E!.SFb ...-.....^...,..C.!.b...i._c...s.X.w.. lsQH..H.gKc@@...i. ....m...;Ci....@G.; V{..lO..\.R9e$..{.....P...E.+.2.0D.B,..P...56.?......K.6..TN....^z.4..T/.z...../.....3..!~..t.]b........E!.SFb ...-.....^...,..C.!.b...i._c..Y.O...?.9k2.M.?5 .n.P...,...d._..%M?....6....,.1..R.4.a.R.+..U.Q..P...vd..T........j .]@....."..lJ../.90.4...Y. ...9.%...{......Hc%.....i..%M?aG..H....o.q.......4.......X.d9.r..CI.O.5.Ri0?.s\b....w...>/k..4V.)Y....P...vd..T........j .]@....."..lJ../.90..2..MP..l..?....K.X.....IEND.B`.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004F.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.353753459191781
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:gBskSkcSaZtI9IE3VpLlmXk9Osu6ooMrdqrgHrJnRX4U9865:YsAaZ6qE3TEXk93l/MRygBl
                                                                                                                                                              MD5:2343A21110F97ACE3947E26EA47AB940
                                                                                                                                                              SHA1:3EC7F3860A5C86924810E8F7456A5526A859E623
                                                                                                                                                              SHA-256:25AA27BD00D4684E9DC302EE5ED02F13D5FFAAB289ADD05D3B50D686EC3583F6
                                                                                                                                                              SHA-512:52752EEF1B907A9C5EB9FF361E436144B5789076A033ACEDB00D48199E448F925395890444351E4CB5329882C441136C9E794DFD1193B6696EEDDF36D988D856
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ%D......%D..`&[.9....n-q%D..`&[.9....n-q%D...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............R...s.# d..z......N...^...............x.F...gI..}R..e(........f........................................I.qk..B.....LZ.............R...s.# d..z...........R...s.# d..z...........%D......%D......%D..........................................%D.j....%D.T.]..%D......%D...B..%D.H....%D...B..%D...>.)%D...J...................;........4...4...4.."..............%D..%D..%D...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........%D......%D.....#%D.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004G.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):34299
                                                                                                                                                              Entropy (8bit):7.247541176493898
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:BrSX4V3P8AIc4KLkHeXRUer0zrhOmXfvG0yH82I:tSXuIc4K2eBtswKsHg
                                                                                                                                                              MD5:E9C52A7381075E4EBC59296F96C79399
                                                                                                                                                              SHA1:BE295AD24D46E2420D7163642B658BF3234A27EA
                                                                                                                                                              SHA-256:D56CEFE9EE2FAE72E31BDBA7DD2AA4426EA22E3CEB22EF68C8F63F9F24D5A8BC
                                                                                                                                                              SHA-512:95CC96DD4459EBAE623176033BA204CCDC50681A768F8CBAE94C16927D140224E49D5197CAE669C83C77010C5C04C1346CF126BEF49DB686F636C5480342A77F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.......................................................................................!.1..A..Qaq......".#4.2r3.$.%...B.5U&6....Rb.Cs.7..cDTEFVf'...S..dtevw.u.........Gg.....................!1..AQ.aq.2....."#3.4....r..BRb$CS.D............?..5..............#....v.q.m.}\..{....;...r....h.....J..q|..'.;\..6..v......e...../.k..|.8..i..|..]..3e.m....n..Z.GS..n".y..w.-...[a...7A.....i.4.)9\..~C...=.........s..\V]c.D1<./.g.l.&v..~.h..]....zb>G..y:vNS.\......LU....t.{*..Z#.?..v-...wn.rR...P.....y\=.v....../..9_...m4...V.|.+.o.#.......xj....}..>.s.>C...m.[;.>.p...=^.i.X.(..1...{.F#N.W...xi.z...4..u[{...yO.....8..}\..2...KlX.nbya...2.&.F...R.b.k.7.GV.x.h.y\.Q..O<\>......-...=...r......\......Z.Z...Jf.'....z..Y.q>.p....o..K....h..R..c.lg?......A.Z...Y.q3.L|.'5...

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004H.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.314968390504956
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:esORtIohqthH7sAxEHSFLCXDbBt9P+otrdqrRgCZxRXVlph1LswsQ2OpDA4d:es+hqTXxEyF2Xj9P+cRy3aQJ
                                                                                                                                                              MD5:0B43A503CCAE4C5B950B0F2D67DE84FC
                                                                                                                                                              SHA1:605F4415A5D7CE989233F814A45052A0A120472B
                                                                                                                                                              SHA-256:373828240D29C4CEFFC5D99E69D08FBADC57DFB14C58E5CF628E10D081FD6ABF
                                                                                                                                                              SHA-512:C750F53D0731EDADB828666D18E146C0FCF4653584D4E343C9D4EBAC61C4B1212077B402BA39BE034C0D9B07CB0E8E95B267D8695470659B0ED9392DB4E9BAAD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ..i.......i5.............i5.............i..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................1W....Q2@Ay.e....N...^....................].F.....//.........f........................................I.qk..B.....LZ...............1W....Q2@Ay.e...........1W....Q2@Ay.e...........i.......i.......i...........................................ij......iT.]....i.......i..B....iH......i..B....i..>.)..i..J...................;........4...4...4.."................i...i...i..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4...........i.......i....#..i............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004I.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 171 x 552, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10056
                                                                                                                                                              Entropy (8bit):7.956064700093514
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:edmu1fpj5DVHuooK4EpGLbAdT+dBXYBR8D1V2p6KwoPR6KUX9ojwRpgA:2Pp/B4LbAF+dBo/1E3S6JScpgA
                                                                                                                                                              MD5:E1B57A8851177DD25DC05B50B904656A
                                                                                                                                                              SHA1:96D2E31A325322F2720722973814D2CAED23D546
                                                                                                                                                              SHA-256:2035407A0540E1C4F7934DB08BA4ADD750FCB9A62863DDD9553E7871C81A99E3
                                                                                                                                                              SHA-512:BC7DC1201884E6DAFDC1F9D8E32656BFAEE0BB4905835E09B65299FE2D7C064B27EAA10B531F9BECF970C986E89A5FD8A0B83F508BBA34EB4E38B3F7F5FC623A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR.......(.....!..t....PLTE.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................4.....bKGD....H....cmPPJCmp0712....H.s...#.IDATx^.w`......$..B....... ....fz5..6`l\.8...Nsz{.//y./....{.7}g.....e.....~.......s...f.....%c...6....O.PJ...Y.oi...9..'j.2..6.-

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004J.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.294398947627875
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:B4LszMMVVuAHaazJotdLEEXh2aLiXhFzj9bVodrdqrQTRZrRXCbVvm1a9:B4LslVGmobEEf+XPj9bVkRyQdZrg2a
                                                                                                                                                              MD5:82160B33AFAF7876BFF4789E5B14492D
                                                                                                                                                              SHA1:70C3085BA3D2A78052741B453BF7C2725B09FC2C
                                                                                                                                                              SHA-256:76C6FB81BD8A77E9934AE5B46E0C8087EEB4181ACDB517804AEF54B84E90E21B
                                                                                                                                                              SHA-512:B0B91E6E39933AF8C5C0031302A939EDA255D5F180A837E3A249AB0E4CDFD618CF68101DB6620EBC29A7638E17CAF725EEEB5CDEB567525BEAEB11326BEBB1D0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.'.......'..5....c8. ....'..5....c8. ....'...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............--..J.........'.....N...^...............d...x.AK../)v..%........f........................................I.qk..B.....LZ............--..J.........'.........--..J.........'...........'.......'.......'...........................................'.j.....'.T.]...'.......'..B...'.H.....'...B...'...>.).'...J...................;........4...4...4.."...............'...'...'...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4..........'.......'.....#.'.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004K.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:11:38], progressive, precision 8, 577x757, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):84097
                                                                                                                                                              Entropy (8bit):7.78862495530604
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:cgHTEuD99rHwA5MSadIV2MApVmfJkAKOQ/Z1I7ngpDDyHfKFVITrU:HHjXidIhApV88/jIEmrU
                                                                                                                                                              MD5:37EED97290E8ECB46A576C84F0810568
                                                                                                                                                              SHA1:18D9FACB4CFA3CBF63B882CABCF30B203EDF4126
                                                                                                                                                              SHA-256:140DD943D0F0CFE6AAA98470B7D1A7CB62CA02CB1D8F522DD2AC77433232EF41
                                                                                                                                                              SHA-512:E0F57314C136211B8253EB2AC0093DED82198E7170D4F97C40D82FD4EC4123D2AAFE3EB4EBC3E7523C4DF4D77619408773871BDE15B6DC6C4049C71D5B9D4222
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....hExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:11:38.............................A.......................................................&.(.................................2.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................z.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....b.xH......T..I...S.q.~..../s.R.x.....8.a..vE.5...-.G.A.4...._......$K..d.@NC.q....J.....>e".I.%...I0).R.I$........M3.F .

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004L.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.31474456614109
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:DsdVjePH6NtqVMoEMxqX2y9PlorBrdqrR/a6RX8rOm804zPSUt:DsreyN0RElX2y9PlERy06uKSJU
                                                                                                                                                              MD5:7377B94790BBCE653920E287880D9A12
                                                                                                                                                              SHA1:E3E38A535F5E854B5C9D60AE076758FF712CD8E7
                                                                                                                                                              SHA-256:971676DE0903B08A681DAD826CE1C7058B28A20E5BB427D3CAF924E5CA10BB25
                                                                                                                                                              SHA-512:02729FB5E51B3911D1BD07A764C33604F6883FA857F082ED49BF9DB61FEC14113ADB93832FFFCFC5661C2A51DD10366485A35A819167ED4B7A534D742D5BC691
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......L...v...@...................................................................................................................................2...>...(.......v...t............................I.......I.qk..B.....LZ...........S....3..D.......S....3..D.........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............3..SQ...-.....qG....N...^...............>....\.I................f........................................I.qk..B.....LZ............3..SQ...-.....qG........3..SQ...-.....qG........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004M.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:26:15], progressive, precision 8, 216x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):64118
                                                                                                                                                              Entropy (8bit):7.742974333356952
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:ORG4azGOKXzkEmR4bdRSbxONOoz0khbSb4J/5GZK5SWUlRwUYdv1M:ZXzGXzJdhRmgHfIb4J/5GZK5SWUldYdq
                                                                                                                                                              MD5:864EEA0336F8628AE4A1ED46D4406807
                                                                                                                                                              SHA1:CFCD7A751DFDBE52A20C03EE0C60FDFFA7A45B93
                                                                                                                                                              SHA-256:7CE10D1EA660D2F9CF8B704F3FAB2966A4CE2627D9858D32C75D857095012098
                                                                                                                                                              SHA-512:0CAA0C54C14571C279A75F0D5922F78A17803CF6EE1724D66819F7F5944C0F5B25CB586BB686A52808CDF2F8FEB3E4864052A914884054EF7DE44124A8CA951E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:26:15.....................................................................................(.....................&...........s.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................#.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....NC+n....<.=.7..&.8A56..@^.Q..\\...E.>..".&G.......J .'....$.I)........0.../..mv...D....<v0=..ugc+..l.o...=.c.......x.&D..{`8...v

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004N.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.283029539967628
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:5g+Osmi3DL4xF56t0lZtt7KEpsXZoE79HHoJrdqrvCBJzFLW6RXCTp7aLUHuQnqW:5osYnIt0lZPWEqXZoU9HHIRyvGfc7px
                                                                                                                                                              MD5:1C3CE7B70DDE26E6B26D39B0E417D1A2
                                                                                                                                                              SHA1:23FE0CC6C9634A08A153363FA10F4D2B686CD28E
                                                                                                                                                              SHA-256:392818E2C60528613E7B680FFC4CDFD6010FC2853FE9ECDC23E62ECC4065CEFD
                                                                                                                                                              SHA-512:69EEA8187B0F7AA18EADED2042A2F9997AF6A1AA578ACA218D1186D0B602347AAC06E84F31DE4C0467417956FBF562988C50C31B666CB722711286F8B211AA13
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZd.7.....d.7.}...,gd...5nd.7.}...,gd...5nd.7..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............?..T.........hU.....N...^...................*G B..`?...3........f........................................I.qk..B.....LZ............?..T.........hU.........?..T.........hU..........d.7.....d.7.....d.7.........................................d.7j....d.7T.]..d.7.....d.7..B..d.7H....d.7..B..d.7..>.)d.7..J...................;........4...4...4.."..............d.7.d.7.d.7..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........d.7.....d.7....#d.7............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004O.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:09:29], progressive, precision 8, 609x675, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):65998
                                                                                                                                                              Entropy (8bit):7.671031449942883
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:klZtmExaFrtWgpc+Sg+DKeplHClpHfRtPMbe:VEWWl+SNDKqlH8p/vse
                                                                                                                                                              MD5:B4F0A040890EE6F61EF8D9E094893C9C
                                                                                                                                                              SHA1:303BCBA1D777B03BFD99CC01A48E0BB493C93E04
                                                                                                                                                              SHA-256:1F81DDE3B42F23F0666D92EBF14D62893B31B39D72C07AEE070EAE28C2E6980E
                                                                                                                                                              SHA-512:8F07E4D519F2FD001006BB34F7F8274B9AF9EC55367B88D41D24E5824FCE4354FD1290CE4735E43930829702ED53F41DF02C673904A7091E9354C28E029AD4EF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:09:29.............................a.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..-O..s(...gO..@...[..+....+...H.'m........L.......@.......[k...S..O..p.'{X..3......]W..w.+.V....[.-.....2..i..i$.p.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004P.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):3.2520008134404708
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:6sXub5l5W0+WEcgvqjX1E+9//qIqIR0TqYupvZtlWGs/Y:6s+b5l5WpcgMXm+9/pqIR01upd
                                                                                                                                                              MD5:D9F3D9496BCDD0E42B778DE2636F9C49
                                                                                                                                                              SHA1:E2B1EF6AF8C3FEB56818A17D85E45746B1103A31
                                                                                                                                                              SHA-256:A0000B4548CEDB33AF3B349C6648278E2C9026DE2AD5404375EAAF50ACCE977A
                                                                                                                                                              SHA-512:D1CBA4F1E485D82A209305EA11F01F813E10B410E5D76B5A3C470A25AA9D6E0A20D912751758FAB0E96654688C4D56CF228212CDDF43057FAAA17FC86CF7CE65
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>...........v.......................................................................................................................................2...>...j.......v................................I.......I.qk..B.....LZ3.......3......eB.<J..3......eB.<J..3....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.....................8.$s.....N...^.................+c/M.E....2.+........&...................................>....I.qk..B.....LZ....................8.$s.................8.$s..........3.......3.......3...........................................3..j....3..T.a..3.......3....D..3..H....3....N..3....?.#3....9...................;........4...4...4.."..............3...3...3....z...y.. x.. ...........$........4...*..7*..7...........Op.b..F.$..i.................;........4...4...4.........3.......3......#3..............................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004Q.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):32656
                                                                                                                                                              Entropy (8bit):3.9517299510231485
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                                                                                                                                                              MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                                                                                                                                                              SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                                                                                                                                                              SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                                                                                                                                                              SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004R.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12824
                                                                                                                                                              Entropy (8bit):7.974776104184905
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                                                                                                                                                              MD5:2628353534C5AD86CBFE57B6616D46DD
                                                                                                                                                              SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                                                                                                                                                              SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                                                                                                                                                              SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004S.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):32656
                                                                                                                                                              Entropy (8bit):3.9517299510231485
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                                                                                                                                                              MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                                                                                                                                                              SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                                                                                                                                                              SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                                                                                                                                                              SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004T.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12824
                                                                                                                                                              Entropy (8bit):7.974776104184905
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                                                                                                                                                              MD5:2628353534C5AD86CBFE57B6616D46DD
                                                                                                                                                              SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                                                                                                                                                              SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                                                                                                                                                              SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004U.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):32656
                                                                                                                                                              Entropy (8bit):3.9517299510231485
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                                                                                                                                                              MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                                                                                                                                                              SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                                                                                                                                                              SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                                                                                                                                                              SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004V.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12824
                                                                                                                                                              Entropy (8bit):7.974776104184905
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                                                                                                                                                              MD5:2628353534C5AD86CBFE57B6616D46DD
                                                                                                                                                              SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                                                                                                                                                              SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                                                                                                                                                              SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000050.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.348674096854203
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:YuA1sgtxP1wW1Ft8Xr5Eya7nXjocF9bHjdXrBrd3rJxRRX1p/DZR:YH1siH1FKb5Eya7XUcF9bHlBRb9z
                                                                                                                                                              MD5:FC8E7B42CCE748D9E6F32450AABFD065
                                                                                                                                                              SHA1:382D3D2A88E6DC61E4B75FEEAE74649A1626B538
                                                                                                                                                              SHA-256:95BD791AB77799EAD9303178FA4472DC51330F660864802B66D61C5964B1D63E
                                                                                                                                                              SHA-512:E435666996206520F9F32150FEBF42CB5D88DDEC257CC9F892A03A365B69CBF6EA7CD94B5E3A6B09D26AA3B8E94B3E860EE9177B96AD01EE043FF554B0124BDD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ...........Mg.d.,.Y.RHR....Mg.d.,.Y.RHR......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............+..NV. I.Z98......N...^..................)7fE.Y...:m.........f........................................I.qk..B.....LZ..............+..NV. I.Z98............+..NV. I.Z98..........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000051.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):39010
                                                                                                                                                              Entropy (8bit):7.362726513389497
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:6tCjwO+E+KW0ZtOgepcoWW4pAWQ6/KWcR474HOAZaDfK:68j+E+KW0HOgep/72/NKWcRNefK
                                                                                                                                                              MD5:9700DE02720CDB5A45EDE51F1A4647EC
                                                                                                                                                              SHA1:CF72A73E1181719B1CC45C2FE0A6B619081E115E
                                                                                                                                                              SHA-256:7E6A7714A69688D9FFDF16AA942B66064A0C77FCD9B3E469F89730B4B9290C3E
                                                                                                                                                              SHA-512:5438921467D62376472007B9EBF3C35C9D9FE3EDE04D99A990129332D53EBC8EE2555C0319A4F7C0DF63516F29CEDF2171D8B6DC34C9FCD075C2CA41EB728660
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!1..A...Qaq..".......2BR#...b%&6..'w.r.3f7W8.s5EUeF.g....CS$4.Vv..Tdt..G..(c..u.Hhx.......................!1.AQa..2.q....".s...3.4BRr.#......b.$c............?........uf.....t...;..[...W.h.....-.k.f..i.u..KQ..b.F...rM%/.8n.S..=9.....G$O;.f.}L..N..U._i.[.X...3.~....S.~..+t$...c.5......{..X/..#.G...}s....6......^....o~.$.\WA?...^*w[O.~..6..~....a....~..:..0.......{O...|.s.u._w.........i...........{K...._.?.../{.....A..8....<g.iu..<..................X......|]v....D..9.k.w.|-IF.Tv.-.&.........."'.4.b....z.._.Z.....G...u.xyt./_.q..m>..S.V.Xdc.bw.T.W......g..........}s.._..?....U]_.......`......>.|'.~xH....,...?........?.q....o../..R..;...Y.G....A"?......?.<..1...w..o.M.........tco.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000052.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.39805324313226
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:zWz7SsR4U5Wza/PtST/4Er+/UcXgWc9wIj4Vrd3r/Axj/kdX+x82jeyp:87Ss26PoUEEUcXbc9wIYRbG8Jeh
                                                                                                                                                              MD5:48204BAD8C2FAB3675BCF2715194E3B1
                                                                                                                                                              SHA1:9C0B3B93881C2EFEF1C669AC75DFBF5E678AB467
                                                                                                                                                              SHA-256:8759F3C1629C9B8A7D1730A53F9AEF5F1BF3E80703953A326CD684D9C11F0207
                                                                                                                                                              SHA-512:D657438BA430E939680C971EDD04B6655EF79867A47626165C18661BC67F17F4DF19B9976CAE4FA29EB73B78CCDDAE7D2179EC54CD7C79A3094D170A74D76D38
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......h...v...\...................................................................................................................................2...>...D.......v................................I.......I.qk..B.....LZ\)m.....\)m...E.5n......\)m...E.5n......\)m..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............!.(;.......nT.....N...^...............@/..ss.N......z.........f........................................I.qk..B.....LZ.............!.(;.......nT..........!.(;.......nT..........\)m.....\)m.....\)m.........................................\)mj....\)mT.]..\)m.....\)m..B..\)mH....\)m..B..\)m..>.)\)m..J...................;........4...4...4.."..............\)m.\)m.\)m..z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4.........\)m.....\)m....#\)m............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000053.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):25622
                                                                                                                                                              Entropy (8bit):7.058784902089801
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:EhK81gTCyJ/Gf9Aw3t8w8EtdPeGDh6bEi1Ie1u4ZbvgwTwrSRh7ZKNpIGY:IjcRXwdJvtdGsUbEi1IeY8vgwTyC1+Y
                                                                                                                                                              MD5:F8CCFC24DEB1D991EBE085E1B2D7D9BF
                                                                                                                                                              SHA1:AF76C22A765434AEDA134924C517C84107F4FED5
                                                                                                                                                              SHA-256:7354001527AB554C44E7D6981B86DD933B7DC2E0D3DC8512AD3EECD843245C52
                                                                                                                                                              SHA-512:818BC3690B01B30BC571E4CF45EC8D1AFCAECBAB003532644381F1CF730A5B3486862D08F7579B2D3D89167AD7DF35028881245C9550B0DA23D1F81A720A9704
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!...1A.Qaq.........."2Rr.#.t6..B..3S$4..v.b..Cs.%5..8..cUV.(.DEe.&Ff...T.d.......................!.1A..Qaq...s4....2r..S"BR.3....b#C$.....c............?..D.."}:......&&...?3..W.q*.......]...m.Y.k1......K).J...uV.b.../.0.E.H..4..W_T.[t.V.w.9.x.qe.L..o.oL.....d.\.....6.|.o...}..H{Yn..E...6Y3.l.e..D.:,.n.%...t...m.........,+,..|..n.....6.*...f........6.../$../Vi..H...e.f.F.zn.).n.E..2sTn.i...Yb?6+H&...Bf..*....z.o.^7[..u.:o....t.s=.....(.s.....f.g....q9o.u1L.N...smzE..[>...+\O....j.<....j.c.W.............U..+.F/.'..W...T./W...>i01./....j.s."..Q...{...a._~OW...Rp.)*.e..W..Q4)<..'..W...q...'..U..z..g......U}...O....w....0F:.N..V.3W.|..'z0.]...j..U[v..g$D.Lc[.e...UW.m0+

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000054.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.332636697002927
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:YusAwTw6ssFHyVsZJWtGIQwIEHGKAX5+9gg6j4Brd3rUoxQUZdXJDxGUdV:YzE6sgJWcwIEmHX89gLURbcKss
                                                                                                                                                              MD5:C4334CC6BBF44042BCCD8A9BB544834C
                                                                                                                                                              SHA1:2A8CBECAC034C526EB72761E48653BAD8F394A25
                                                                                                                                                              SHA-256:4B8FABEB1947390DDEFD3157B872C23AC7BB496CF9B1E5E9A6F781B096B73AF4
                                                                                                                                                              SHA-512:6EDB259FCF74656C378341F4DA497AEC9617E2B6591201AA445E8C41F7FCCFBDDF0CD248B6CBC30EB697C8717F65B0E423BF74C3B95D070CCBC7E35E0D6BC457
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZy.......y.....;.1Q..*.5.y.....;.1Q..*.5.y....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............U.../I..1{..l.a....N...^....................I.I..|..'o.........f........................................I.qk..B.....LZ............U.../I..1{..l.a........U.../I..1{..l.a.........y.......y.......y...........................................y..j....y..T.]..y.......y....B..y..H....y....B..y....>.)y....J...................;........4...4...4.."..............y...y...y....z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4.........y.......y......#y..............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000055.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 50 x 500, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2033
                                                                                                                                                              Entropy (8bit):6.8741208714657
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:P37XYSDTz+UUl7DHt7Ah8l1+4ZfFclFUXwobKXlZr:v7j3z+UoDN0h8ugf2AwobMN
                                                                                                                                                              MD5:CA7D2BECCBC3741D73453DCF21D846E0
                                                                                                                                                              SHA1:E34B7788498E33FFF0CFB00125E6BA9E090F6CED
                                                                                                                                                              SHA-256:E9EAD0BFC09D32CB366010CDFEDE1C432A2D1D550CB7332BADAC1BEE9482BC86
                                                                                                                                                              SHA-512:7FE2C3654262B1EEBED4F6D83DA7D3450E1BE52500A3964185FC0092041506A237A2728E5D7EEA0A3814E413E822B803B789C49CF744D51816A2E4EDE5B4247B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...2.........H'......PLTE........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................[....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.\.W.G...=a.ewA..a.!r( ...%Dc..x.x....N.OO...3=...S...........~.z.D.0...g.2P.7.*M.#'....z.......3TPj.Z.[5....V..z'L3...a.j9..C>..9.z

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000056.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.343929134039691
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:6sy+qcf8I6rbxhtwYWxEkJLxXSoz9Eej41rd3rAx2ddXe5ZZNdMq:6s7fd6rbxhCxE8lXT9EeARbJod
                                                                                                                                                              MD5:BDF814FD4BB5478A76BDE4EC7461C6EB
                                                                                                                                                              SHA1:B4DC7579EC1224A0561D145407DA31241AA65A9D
                                                                                                                                                              SHA-256:BE4CE9D2EA28E6BFE8EDE3FB8306260644E6AD3423D7AA86471C25F5EEC16147
                                                                                                                                                              SHA-512:2A10C2F6A99A44A48B7618CBD049D76551EDB25E437D2941182BE56DF7131200CE0565653CFB4EC2A3443E15A780214291E9F613F41F71660915E6C71C810FA4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.8)......8).?@..>3(..I.Z.8).?@..>3(..I.Z.8)..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............r...Vp.0\d]..[(....N...^...............J......I.q.f..t........f........................................I.qk..B.....LZ............r...Vp.0\d]..[(........r...Vp.0\d]..[(..........8)......8)......8)..........................................8)j.....8)T.]...8)......8)..B...8)H.....8)..B...8)..>.).8)..J...................;........4...4...4.."...............8)..8)..8)..z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4..........8)......8)....#.8)............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000057.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):55804
                                                                                                                                                              Entropy (8bit):7.433623355028275
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:gVvci05lhVbfBcWvBLeynluexaWqzww/u5:gVUZhHDljaHww/u5
                                                                                                                                                              MD5:4126992F65FE53D3E3E78F6B27FD49DC
                                                                                                                                                              SHA1:BC0D76B69310DA9B909D3EE4CECBFE5F386BFB45
                                                                                                                                                              SHA-256:3FBE3C1C238BD7DBC67F8CFF5F3BDDFD513C96A9851B9616477947D21DFF4B2E
                                                                                                                                                              SHA-512:624853F5E56D224C8188F122B2C4724F867D4099E7FAAFB9C945BE7E2907900ADCF4AE97AB08909CF94E96FB6F381E3B6396D560D93EB2731E4E69CBFE628F10
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d..............................................................................................!1...AQ.aq"2.....BR..8x..r#..9b....3....CS$.'.cs.......7Gw.(.4%5&..Wg.h......tEVfv..H..........................!1A..Qa.q...."2..u6....BRr.#...b..3s..d...7.Cc.$Tt..S4.5Ue..&..%.................?...,...8..{..S.y.N....%..q.8..H[5....o..xg........)c(.eO.YO..._D..x.U.....%.S.r.r._.^..Su.h.Q.t.:.#?....x..B.S...Q.....oqF..%..8'.qx....%.2JKjF..{y.w0.*a.RMb.c.Q{%....eW'..[IV..'ZW3...[...MN.....rO.:....$.i..7....Vrrr...I.r..M..Qo..j....q.^...N...J......%.J..)F...>$.....u........o...+......[...*..t....R}.I..R..S..GB..:......).6_[^Xft...F.1.....zP....,.#....MG.T..Q.F.....)Fi../.I...,%.voEb.b.Z..V3..FT.}..[Z{....wd.z.e.....QwW(.).t..\..'....:)<W.<..&k...caRT.X(..K.....:f...]...q..

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000058.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.471818596443102
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:VWsTyLzKHtrzEWX39MMYRM7GmK54bKo+5:VWsTwKNrgWX39MMYRMSmK54bK95
                                                                                                                                                              MD5:63BEA40184AABCB1C38C6F6446864888
                                                                                                                                                              SHA1:B68AABB03BE0B6A1DDC7101EDF66F2C200E61D05
                                                                                                                                                              SHA-256:3CFE73C1E1FCF83D3E2F0B422C2DAE449862A8F50657D5E77779D699C2832B5D
                                                                                                                                                              SHA-512:0517A6C8D21F084B0DFA683C74CE8C0ED6ACAA18E1428A91F597178EEEFCD1F101495218B32159EE20811AD534D96B2C2BF5DE82F644E084EA9B951C63FE15ED
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......n...v...b...................................................................................................................................2...>...J.......v................................I.......I.qk..B.....LZ.[.......[.J.KB.6.gs4....[.J.KB.6.gs4....[...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............*...s.......l.......N...^.................'...@L...p............f........................................I.qk..B.....LZ............*...s.......l...........*...s.......l.............[.......[.......[...........................................[.j.....[.T.]...[.......[...B...[.H.....[...B...[...>.).[...J...................;........4...4...4.."...............[...[...[...z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4..........[.......[.....#.[.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000059.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:08:07], baseline, precision 8, 595x450, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):59832
                                                                                                                                                              Entropy (8bit):7.308211468398169
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:HS9SYFtN0+CRa9mfJy4zBAiIJhzrkHDV2hJK:yAmta+Tyy4zBIJW5WK
                                                                                                                                                              MD5:DCDD543A4E0BA2C1909BA095D46FFBCB
                                                                                                                                                              SHA1:B86C89537138FE07255354202D3EAD0B53B3C54D
                                                                                                                                                              SHA-256:28F334B77068F71F5F92A95695433B950610204A0E5580CE567DB8FAD4993ECB
                                                                                                                                                              SHA-512:5408C3259B7F3288A4BEB04342799AD5FE3A6F0EC7E92353B29B7E7E538DFA9903B39637226919E0421BC422635D25F5F8069DC7441864DC03E1B909BF5C2C84
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....fExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:08:07.............................S.......................................................&.(.................................0.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................y...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?......;R~+'....xh..~.n-}.......Te................^B..IU_....._...S......h.......!....9...A}6V=J......C..c.....Ug.Wh......

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005A.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.314738817620882
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:DsZil4u2RLJZTtUEQ2MX19E37j4TVrdMr+KdXNov2vXhTh+Yg:Ds5JZTWE6X19ELcRMJ4Y
                                                                                                                                                              MD5:4FAC9FAC9758E464EB7A5D8E348F39A7
                                                                                                                                                              SHA1:66E01851AB78AD392C9AFBCD9BB78A89C1C5A85C
                                                                                                                                                              SHA-256:78F463FD2E7C78D93ACAD72B4E47E5F8E27D1D9BC353C56210FE3F1460B34920
                                                                                                                                                              SHA-512:565DAA9F699578F85B68794B19E2F2920FD38ADA329751418BD63155C9D64DC5A91981A4A0DA62425F05C716587FA049456EA4D2154AFA8E958B5A1371EDB5D8
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ.7.......7.D.(d.-........7.D.(d.-........7...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............>......6..g^.S....N...^.................D.C..J.=.[&.ps........H........................................I.qk..B.....LZ.............>......6..g^.S.........>......6..g^.S..........7.......7.......7...........................................7.j.....7.T.^...7.......7...B...7...C...7...>...7...|...7. .3...................;........4...4...4.."...............7...7...7...z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4..........7.......7.....#.7.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005B.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):33032
                                                                                                                                                              Entropy (8bit):2.941351060644542
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:ofmqvnCfmqsp1Ue5xzMq+Qh0dffUmS0w5xzMq+Qh0di:AGAp1rmSl
                                                                                                                                                              MD5:ACF4A9F470281F475EA45E113E9FB009
                                                                                                                                                              SHA1:B20698DDA5E5AFDD86BB359A6578C9860D5DF71F
                                                                                                                                                              SHA-256:5DC2367A80588A7518DB5014122510BF0FD784711015EF83A8718336584F82D0
                                                                                                                                                              SHA-512:998B7DB9DB08FD15A293267E2371052E436E024AF8D34F96D3C8FF04B1316678DFC1674C921CB404121FF381A4FC39DC759E6698F19D42A6261CBD39469B0A08
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....l...........................Ac...... EMF........$...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC........................F...(.......GDIC............^...........F...........EMF+*@..$..........?...........?.........@..X...L........................."B...B...B...................?...........??.....n............;...<..@<...<...<...<...<...=...=.. =..0=..@=..P=..`=..p=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...>...>...>...>...>...>...>...>.. >..$>..(>..,>..0>..4>..8>..<>..@>..D>..H>..L>..P>..T>..X>..\>..`>..d>..h>..l>..p>..t>..x>..|>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...?...?...?...?...?...?

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005C.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 3005 x 184, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12180
                                                                                                                                                              Entropy (8bit):5.318266117301791
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:k1bHyG/fKOOOOQJUg+g2S+kEm6alfsfsfn32:+bSG/yOOOOQ+g+gOab32
                                                                                                                                                              MD5:5C859FF69B3A271A9AAB08DFA21E8894
                                                                                                                                                              SHA1:3156302A7450ADFF4D1B6EC893E955D3764D4DD4
                                                                                                                                                              SHA-256:B4A8E9A67EE0B897615AC4CCE388FFC175AB92D9E192E6875C79A4E7C1B5BB6E
                                                                                                                                                              SHA-512:4CF518136EEBCA4F400A115D9B7BB0CAC9FA650BF910B99E15F04A259B7D3EFCFFD6796886FE09DB08C37C332B14BC8500845C09C8EAE1F2306F90E98D3C99E0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR..............;j.....sRGB.........pHYs..........+..../9IDATx^...dW...S=.dL$.............-.`...'...x.7.D...(...$.?cO....9S]=.v...Z.......{..wNuf.&.....a.k5~...._..\.yk..v.....}{._.Q...5...._9o.n.....}7.].1v..t......q....3.<..0<.p.......0....s...... @....... @....... @....... @....... @...X.'..U-..... @....... @....... @....... @....... @......,I......+..... @....... @....... @....... @....... @........z...r.. @....... @....... @....... @....... @....... .$.C.KJ[.... @....... @....... @....... @....... @........&`.=X`.%@....... @....... @....... @....... @....... @....../)m.. @....... @....... @....... @....... @....... @ ....`.)....... @....... @....... @....... @....... @....K.0.....J....... @....... @....... @....... @....... @...`.....\.... @....... @....... @....... @....... @......,I......+..... @....... @....... @....... @....... @........z...r.. @....... @....... @....... @....... @....... .$.C.KJ[.... @....... @....... @....... @....... @........&`.=X`.%

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005D.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.35344523174128
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:osjPHoprtrStEPEczowLPTXQ9EsRp5WCrdMryNqxQX5969A1Ix1:oskprUEsAow3XQ9EI5RM7x
                                                                                                                                                              MD5:ECADC70C80DEA34B96582A2E56EBBF29
                                                                                                                                                              SHA1:81A700FE9ED87928F6263D37B4D3265504B4A495
                                                                                                                                                              SHA-256:3A61FF2821DC80C73435F582C013A6BDE3E9A7CC1BD98D56FA8C00E16306560D
                                                                                                                                                              SHA-512:B000D83BB4C7F023C3F299F0F58EB8CD6380B679A230AE35AFF40A69DE4126E12A782A67FB9938707F950F90C662DC7D12706FD9B4371F85FB9536B872CA23A0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ._$......_$3u... ....u..._$3u... ....u..._$..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................FL..2....X....N...^...............n..5...H..#6.{.E........f........................................I.qk..B.....LZ................FL..2....X............FL..2....X.........._$......_$......_$.........................................._$j....._$T.]..._$......_$..B..._$H....._$..B..._$..>.)._$..J...................;........4...4...4.."..............._$.._$.._$..z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4.........._$......_$....#._$............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005E.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 39 x 600, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2104
                                                                                                                                                              Entropy (8bit):7.252780160030615
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:2PPEOtz2P/LJtVRaqBG8qFOPvHlcEXgkuwf+j:2PZFSjJDjqFOPPlXgG+j
                                                                                                                                                              MD5:F6C596F505504044DF1E36BA5DA3F09B
                                                                                                                                                              SHA1:BCF17EC408899B822492B47E307DE638CC792447
                                                                                                                                                              SHA-256:EDBB86F160050FBF1F9860276802BAE292DBFD0BC98E3EA90D43D981E9F0C54A
                                                                                                                                                              SHA-512:E8D067A1932CED8746FE7D665EEC34EA92A98AFF3DF26FFA9DD02742DDEA3C5654124A88A649FA33DB596F96A5FC9CB2C693D03132F1C8B254ACB56DB4763BD8
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...'...X.......:....PLTE.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................{.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^..c.%i.F...m.m.f.m.m.m{&....X...9.....M.WUW.d.N.O...E$...$...)H....n....N.k..v.....v1L[w)w.}..!...Y.X.V.D.......[....;..[..;....

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005F.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.345398175811758
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:R+XDsde4Y6L+Otj3E2JlZMBXFGY9BsTpy9rdMr1DdmkuFX9pzPEHVj4g:EDs1LL9E2iXFj9B+ARMFIkuhQj4
                                                                                                                                                              MD5:194A46ED0C42624833C89252D2DC6317
                                                                                                                                                              SHA1:3B828E5F1D02A19C8DCE6F36746599AC85A202D7
                                                                                                                                                              SHA-256:5B85E6A890BC64B8C752FAC5508115ABB21F2044049367C56AA8C0262C5A3636
                                                                                                                                                              SHA-512:ABA1A7BB7DD30FDAE2FAC52007FBA3B65DF44ED015EC3B31C825B6BC807471794ABB9DA51F0636317C6FF3CBF15981F83791F8B2025837530DD1D47EBAEE8B79
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ6.&.....6.&..S..>..K.Fw6.&..S..>..K.Fw6.&..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............)...v...09.........N...^..................'.SO.I....O........f........................................I.qk..B.....LZ............)...v...09.............)...v...09..............6.&.....6.&.....6.&.........................................6.&j....6.&T.]..6.&.....6.&..B..6.&H....6.&..B..6.&..>.)6.&..J...................;........4...4...4.."..............6.&.6.&.6.&..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........6.&.....6.&....#6.&............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005G.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):14177
                                                                                                                                                              Entropy (8bit):5.705782002886174
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:EbgGcV/hlvpfal7rgYa8S7auAxwfuSTmCSNoFQ6NO7L:EbgGcVnpwimnd38FdQL
                                                                                                                                                              MD5:7CDCE7EEBF795998DA6CAC11D363291C
                                                                                                                                                              SHA1:183B4CC25B50A80D3EC7CCE4BF445BCFBAA6F224
                                                                                                                                                              SHA-256:DE35AF949D4F83E97EE22F817AFE2531CC4B59FF9EE6026DCA7ECEBC5CF2737F
                                                                                                                                                              SHA-512:560FB15A9C12758D11BB40B742A6EAD755F15AD10D6C5DEBA67F7BC8A2AE67C860831914CBCBCDED9E6B2D1D5F26A636B9BCEF178151F70B4D027316F94F27E1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!.1..A....Qa".q..2.....&...B%6.'..R#3.$E.r457bS.DUFV.Wg(.......................1...3.Q..2Rr....s.4.!Aq.S.aC5B$%............?...n.Liq.}.{#....3/gg.1.M +..~3...q..+=..:.g.i1;P)7.....q..n.s"p...wx........v.t.f;..L/..~....y.r[.r.....n.n3..6i..g..}../........3..x.L.i?We..l.......~..<.;..6..o.....N.t.o6.l..~.......<...m.V...Q.7k.u./wq.t..;.I...}..{...>.L..3m..a....yd......6~.f..~Y..}+..<.[w..'-..?.v.7...v.u..4.......1];..u.MO.......s..p..ms.'.O-o...O......m.k.e....)t....i>..E|....,iOyD|.{......g.n...cu....=..........h.\.Q:?g/?.I.3._...t...d.n.0.%y....S.Q....S.&K.w..&wY<....%.g.v.....$y..#,i;.=...t...I6..yO..o.d..w\k...~......)..rK.......].u....N....e.s..kU.u..'}

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005H.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.342351053545077
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:HpOro0saecaRSl7FtgFLEYXL7rT+X0N9Js3pyprdMr9WFX1x89qSPLUSrhTB:HpR0sD47FKEQTyX0N9JWURMMrCj
                                                                                                                                                              MD5:F7190B7366630190A30E83C7049814EA
                                                                                                                                                              SHA1:53D4A0876C6116377B6C8ECBD4ECD8C62817EE50
                                                                                                                                                              SHA-256:36E22AC46EE4BD24B6205DC4B1E37920B39BBB7B75592D08F02E6C324D936989
                                                                                                                                                              SHA-512:878BC80D9301754B9A45F3D9734E3623A3A823C1D5A7FD6277C5BE8EF1AC87761823801030E7F9CCF0A0B6323C3D1D3B07487B720358C2A8C53AF87E0871D044
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ...........zw.....}..t.....zw.....}..t.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............j..>..|./...;..m....N...^...............s..]..{C.#..dm,.........f........................................I.qk..B.....LZ............j..>..|./...;..m........j..>..|./...;..m........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005I.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:44:07], progressive, precision 8, 611x163, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):36740
                                                                                                                                                              Entropy (8bit):7.48266872907324
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:3nwDxjTvoE0Rjwit4rjucDILWg7/Da0JgGQ8e1S8SA/Khos0:SxjTmZw7nucDILj77a0JgGQvScb
                                                                                                                                                              MD5:9C205C8D770516C5AA70D31B2CA00AF3
                                                                                                                                                              SHA1:9A1002F0CF7F92F1BE2BB25BAD61CEBFAC282482
                                                                                                                                                              SHA-256:E111F96490755C7D71E87C88ACAEA38AFE55BB865B1A14A83C5BD239648D5E2C
                                                                                                                                                              SHA-512:A3E105208B32831265428572B0937DD3C17B793D8611B2DA8D4939F1BEC6050999D375E3F6B87D53AD49DFA0EAE737B0141D37597AA42116C310761973D4A134
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:44:07............................c.........................................................(.....................&...........n.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d................................................................................................................................................."...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..o...4.gP.~.c...K{...V.=...].<.........vS.........s....(.t......X......kk7....~-...yF}^c.Z.\.G./.?t...>....:.>......./.ib..).

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005J.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.4563076448938865
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:57scUSA/7G2vlMtJrELLdNXTn9psXpyxTrdMrrjzR2FXS05kr2iog:57sAYq2vu7ELrXT9pq4RMr52I1to
                                                                                                                                                              MD5:41B7643D7AD5A533FFCD4FEB39AF4FF6
                                                                                                                                                              SHA1:3027B2A159BC4857F59FBCD6036E59171D55138F
                                                                                                                                                              SHA-256:946F14833D8A1CDDD77419185D4450569504BD64F56D3E969BC2299ACB240855
                                                                                                                                                              SHA-512:97C5346C567596CD7EDA2EFEE77F5DA44E89E25FB6180FD61F1BD7F9FE48612560CF8BEFAE7BC9D3F6AB0983B67DEDE65981145FFE8D86A9FB00D7AED7649BEC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......l...v...`...................................................................................................................................2...>...H.......v................................I.......I.qk..B.....LZ<......<..R+..s.%..p.<..R+..s.%..p.<...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............~O]`+1..&..........N...^..................%..&L..P._HE\........f........................................I.qk..B.....LZ............~O]`+1..&..............~O]`+1..&...............<......<......<..........................................<.j....<.T.]..<......<..B..<.H....<...B..<...>.)<...J...................;........4...4...4.."..............<..<..<...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........<......<.....#<.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005K.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):53259
                                                                                                                                                              Entropy (8bit):7.651662052139301
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:dCiCBBenRYWDBCipMYGTbYGLHbXxoP/qEF+MU50qyJ30h2W474S/Aq/xc4674bi5:dCiIQXBCiwbDLHD0/sFyVel4Pi4UgE
                                                                                                                                                              MD5:2EE369ABB7936F8C28FF0ABDD224EA05
                                                                                                                                                              SHA1:FE9D304A7B49E31EAE439369ABC548E265149636
                                                                                                                                                              SHA-256:FB12D59B8BE911247BBAFDD416852E8B74B028005A141CB4DBBBA109B4B6ED2C
                                                                                                                                                              SHA-512:5CF396CA472C32AE988600176114106CB1619404DD899A3867A5AB43DC90583B771EF69B14EF50E56A21F038BF51D8463C6ADD2DE9D4CB523F6290E24A4DECB3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..AQa....q........"2..R..Bbr..#S....3$.....C.4v..(X.DtEUV.....cs..Td.5uf'Wgw8Hh........................!1Q.Aa....q.2...."R...r..3.t..U...B#S.4ub..C$d.5Ee&'7c.D%sT..............?.....?...k,lk^...M".Yo5.Qp.&s}b.m.:...W.x}.*.a......N1..d-n.-..^..b..TZ.W..."....F....^......ve5...^...2.:i...........~u2pK.z./&..u..L[I....Y....@y{|>..MN=:....Q[..H....a........|%..4fV....).....^.9b.f...F...p.=.W...aZ.........Z.t.n.....z3..[..lVh..\.N-.._.sK.y.._e.G.jig.a.7^....u...*.p.5.a.].........u/u..D.yl.XA..f.z..~.x.....N.....b=.uv.2.t.'.N.-.H..n.v.a.A[.Z.....T2...._...:....h..l.E..sm..a.3I...RE...fWb.Ek.0.#.)..Y#T...........u{....U....s.].7_H.2.`O6...P......}..4LR....]4.mid...

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005L.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.346753086057036
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:Gs1t0tUaxK7OPjtNkxEXDJmuXGwL9BsupyVrdMrtpvFXUdZVDZ:GsYUCK7OPjcEXjXGwL9BzARMjvED
                                                                                                                                                              MD5:2EFE00BC2508DFD2E80135DD5A9977F7
                                                                                                                                                              SHA1:BB2C8CA44BED58ABEDBAAE5AA344D12201BF0346
                                                                                                                                                              SHA-256:717EA3F27F2789A5A111F1022020E95C9DDFB03EC72AC60E0325460BBD5F2C24
                                                                                                                                                              SHA-512:9FDA902F86B8E9E7072F0BAB2B812CED79E6AD153CEBA4F9E3917A2A1CB0E02CBA7FC692963FAFF477A982707ED84F698FB0F006C3A8D8E1D563BB0A808A1891
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.o.......o.."x...G.T..l..o.."x...G.T..l..o...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............(sp.....Ph..d>....N...^...............mj.E...C.W...........f........................................I.qk..B.....LZ..............(sp.....Ph..d>..........(sp.....Ph..d>..........o.......o.......o...........................................o.j.....o.T.]...o.......o...B...o.H.....o...B...o...>.).o...J...................;........4...4...4.."...............o...o...o...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4..........o.......o.....#.o.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005M.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):60924
                                                                                                                                                              Entropy (8bit):7.758472758205366
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:kU7O7+CFqO6DkxTgPzo2wqggrrX8QvN1I/ZLBttB9+dPFXbc:hVuqJDaTqo2wq1L84N1I/Z1tT9X
                                                                                                                                                              MD5:D58C51D2CF586A5E14A9EC8529C3B0A8
                                                                                                                                                              SHA1:F4811A353797C29B1E3F5A61B125C46E1534D587
                                                                                                                                                              SHA-256:F927C7825851974A2149868146970706523A49165133CEE6027A43E8C9ABDF27
                                                                                                                                                              SHA-512:34B963173AFBDF07432F4B983D29F10376E4771FE666E9D50B1A81DA0B9F6001FD86B4A08B9711386DE153BF6E03C8E932E2D181C8EAF94EFF34D20FCA7570E0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d................................................................................................!1AQ.aq....".....2B...Rbr#.s.4...3$.5u.6v..CSc...DT..f..t..&F........................!1..A.Qaq....."2....B.s....Rbr..#4...35...CSc.$...DTdt..%..............?....O<......X.O.Fg..{.W&u.u.T~.|r;g!.._X..N.p.4.........................................................yK..xd...6..|%....\j..e.=...Y..f..I.|-....e...$R.j.......~.W#....{.....V.k.|F..z^..:.~..f......"x.....L..K..r../.;..[..l...;.U...W...X.........8.....y?..B...m.......j..Q.g3..G.K....GL.o..n7a..Y..[.'.........x........\......~...f...0\Wc.n?k.|.....1.ww;..2..?...r4uF.MXdB6..W..mG2NJ.E........u...2.q...Z..=(l)jU.X...U.\X.......O<......X.O.Fg..{.W&u.u.T~.|r;g!.._X..N.p.4.......................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005N.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.357578830312318
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:IsaC+rDAtin2aBtzexWxEJtLQxX0fx9JzsSpytrdMrzc2FXAg9qD0zyYGGt:IsxpaBYWxEkXw9xv4RMPZ
                                                                                                                                                              MD5:AF47186CE7DE78F74E24B87FB69637DF
                                                                                                                                                              SHA1:845ADD1B8ADCE0693D35924F843675C6CD7561F8
                                                                                                                                                              SHA-256:E89FE31AD39DFBC1FC2BB3116CC7B6E8A797B10E0DF9C660B0AF09215A9433D3
                                                                                                                                                              SHA-512:5C1D083480049B0104F5AB79E346B482A35DD641FD6712C2F9ACB10F817D2593A2ED234AD91C7E14479A1F3BA4CA7A93113F2BDB339F39B5B442BAE63C1064EB
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZg[......g[...u-..*.[f...g[...u-..*.[f...g[...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............:Uv..._...yH........N...^...............lD.J...D.......[........f........................................I.qk..B.....LZ............:Uv..._...yH............:Uv..._...yH.............g[......g[......g[..........................................g[.j....g[.T.]..g[......g[...B..g[.H....g[...B..g[...>.)g[...J...................;........4...4...4.."..............g[..g[..g[...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........g[......g[.....#g[.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005O.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 39 x 579, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):515
                                                                                                                                                              Entropy (8bit):6.740133870626016
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:6v/7su2/c30mqkg9VgFHe7Ll8UmJX/N+1Zmkk8f3lbtI4:4mc38gFHe18lkk8f3lbth
                                                                                                                                                              MD5:E96BE30D892A5412CF262FEE652921CA
                                                                                                                                                              SHA1:8190A0BFE21D04BC6F3A406E91B87CA69C03A2DE
                                                                                                                                                              SHA-256:0E31DA4DFCFF4A36C64C1CE940362D2309769F36369E4C43C317D5F2FA15658E
                                                                                                                                                              SHA-512:D647F51ABBD013226A6ADD0D551D058C633F867F9AF5A9E099B85D6E291D220F7B85958B07381CD4C7C4F72356DBAFE2A86932AE398E28C56CDDF0744E92EE24
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...'...C........b...`PLTE..................................................................................................bKGD....H....cmPPJCmp0712....H.s....9IDATx^..I..@.C..<..?mo.#C((.J}...~..B...b.I.i.\<.e.....(p.I.EO...q.x.......dRz....K..b0.:.<c.o..0.x\:...F....I&..ap....."P@....DO...q)p*..@Y.CL2)=......1.........4....._.G..^`..lDO...q...X....SL..z....K..#.L#..I6..ap.Ls.,....7&..ap.p..lI...,GO...q.....k.n1..4......3=.f.x.$..4.....o....x.$+..0.x\.,&6...............IEND.B`.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005P.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.351918207000257
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:isg62UXrS6OtY4KO4EPA8ohXvFK69psN0pynlrdMrtZq0yWFXAAEJgQg:isU6ORkEPsXvFn9pM04RM7q0yWm+Q
                                                                                                                                                              MD5:01C4EF07D70019E896B4C8F0C22E3114
                                                                                                                                                              SHA1:3C0612D7C1428CF4FDA835FDD97E90501F505BD9
                                                                                                                                                              SHA-256:670A51776169EC172034D8734AB739900D79CD6780E706D959E7E94829CC561A
                                                                                                                                                              SHA-512:0348B57602357A178889B8F60ECEF80B32DA3C4A182EA5889E64270B6DBFF520D8B9872FCA76616A549D2FC0DBD19C7D2AED7EE385ED4B49E5B2DE96805DC344
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ..n.......n..Y........?...n..Y........?...n..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................y..B.S8.......N...^...............)8.#.OD...1a..........f........................................I.qk..B.....LZ.................y..B.S8................y..B.S8..............n.......n.......n...........................................nj......nT.]....n.......n..B....nH......n..B....n..>.)..n..J...................;........4...4...4.."................n...n...n..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4...........n.......n....#..n............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005Q.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 30 x 700, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1547
                                                                                                                                                              Entropy (8bit):6.4194805172468286
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:dZeDNYbS+238CTUFPA6SXG5qSacX9q73eXu0vC3dU+OB2gbwHRuZ:dykp9FzBBacXQ3uNC3n7xuZ
                                                                                                                                                              MD5:0BA36A74DFBF411FAB348404CCEC3348
                                                                                                                                                              SHA1:4C619790E517416E178161028987DF1CD3B871CC
                                                                                                                                                              SHA-256:2E7AAF26BEC32148B96442E8FFF1BD2CEF2D72630969F23B9A2ABEDB6CFEC93B
                                                                                                                                                              SHA-512:90AF53DB7C413E2ADB970AC345F73E4ED8AF626E179C929E6560118F7A9E98DC7C5FF02B2B3F6C98D397E0FE2D85F3427C6928C328872149E176FA8A99E91F54
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...............\....PLTE.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................D......bKGD....H....cmPPJCmp0712....H.s.....IDATx^.WSTA........b.0gPPP0..E.9b@L(.c.N.U>..@......;...}..B.(....$......5..XS...I....).!....D^.uE...\..5........F."o..-...m.n. .^.....q= .

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005R.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.359596832658992
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:Ws+HFH1Htq6SMKyZ5AOE2XD9iHlgRMIfKH1H6HFHCHFaH5:WsKVFtqQf62XD9igRMIfeFOVGFu
                                                                                                                                                              MD5:201AA96F63FA5065FAB92CFE9FE655B4
                                                                                                                                                              SHA1:3D55D909B81CFA1CE01FC61370005DE423538A15
                                                                                                                                                              SHA-256:3CFE1808954C455BA0EFE549D5B9C4704484C01AF86BFF176368868D8F66D1C2
                                                                                                                                                              SHA-512:A55EFAFB76690FF598EF37E1CA3E989DD89C34BF73FFD3C3EF55B934F40D685573C57FCA209A1B0B976EE188DE099E450528DB959E62EC1D68E3151A7F656655
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ...............9.P.v.jT.......9.P.v.jT.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............c.y.H...-../........N...^...............:s...QL.PG....]........f........................................I.qk..B.....LZ............c.y.H...-../............c.y.H...-../............................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005S.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):95763
                                                                                                                                                              Entropy (8bit):7.931689087616878
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:EoES7mhTyzabUaE77xAOmq0zVruQlttNxlipxVWssMU2YhRy2v6pKKYhQzwMc2:zz7mhTyzabUa4b4xuQlttnlGx8x9h02M
                                                                                                                                                              MD5:177DD42CA99CAA2CCBF2974221680334
                                                                                                                                                              SHA1:35FD86B3DD082A6D4930C67BC0E05D3B5817465A
                                                                                                                                                              SHA-256:525A857D0EDA855A64D3619DF58B1C2D013A73E60FA0D49B155ECFCB2C134C7C
                                                                                                                                                              SHA-512:6FB6D9A6C97B1115C3246690A2F339CD612899AC25ACBA00296EAEAA0A1D094E7339D670969764FE23EB7C08FCDD01C6F78FBC0735D504D5E02AD342901719B3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!..1AQa...q......."...2..B#Rb3..r$...6..C4....Ss%5...tu.c..Dd.EU7....................!.1.AQ..aq......"r..2...4Rb#3$B.Ss............?..H..dV....U..-..0]Cp.%O.Z.Y.e.=/.q.....j76.w@s...5.&&&5...n..w..>.1....;.vR..[.......=.......KtY]u3.g18...).r....&.IZ'.....g..4kY..X..b.......y<...r1........e.._...X...w....op.m%Jr31...S.Vo.._....OI\]....F..V-....\...2j..X.....y.p.$4.....&#..]..n.V..x..P...F..C.f....])..~..Z\.....,..#..v..v...2V.k.SuaydO../[.*c._..oTV<Z.s.[...o.x..>....-....v...#....-.X..L.Z./#.XG.-.0......%w..H.@aZ....C.}...N~.;..R......5.D......I.... .R........s.>..ks....(...S...9....2=. :^.. p.+?(....$..Q..I.........=|..`2. v..t......U*.8.u.. ...'...*...2;u....& 3..$.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005T.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.342760262701568
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:isG4HWdEy0JXHnL9aigRMweIfvS/IUQx:isG426y2XHL9ZgRMweIfvS/I9x
                                                                                                                                                              MD5:47E6BF5CEEDEC4F059BE627CF4B9701A
                                                                                                                                                              SHA1:587DC531B933CA847840236BA7530ECB46A4D8EB
                                                                                                                                                              SHA-256:481415FDD67C660D95AB3B0FC3A2F316FA4684A79D7F4D06B8116E59ADCBD624
                                                                                                                                                              SHA-512:CF0C50EA3FB0A6F1F5397DE9119407E3D87FBCFA7F33AEB9AFB7F6ED7A68E68EB6147FD43B680833BBE1A7B6703AFB54116BC3FD939225318DA3A8DBE6F9B706
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ...............*68*.C.........*68*.C.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............i.!..Y....0.........N...^................TFL...D..?T<A.........f........................................I.qk..B.....LZ............i.!..Y....0.............i.!..Y....0.............................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005U.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):67991
                                                                                                                                                              Entropy (8bit):7.870481231782746
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:3PC0XJjsmsKuZRG1pXuZ6z3wARnV9AEnieCc7cllJcHJ:qyMBzkUZ0gq25c7Z
                                                                                                                                                              MD5:1271B1905D18A40D79A5B9DB27EE97EA
                                                                                                                                                              SHA1:9618608FBD7342DE6C71220A36C3F4995BA9C13E
                                                                                                                                                              SHA-256:5B321A4D81BD499B289B1755F6450A42047C494DFBC112DBD56DA4CED2C15C1A
                                                                                                                                                              SHA-512:C32DD26047F6B8AA061085B38AC2B8335868E1BFD8731DB65544309223A955FA4BF45B06AC8D244408658F51A1775B6F19FF0FFC804989DE706DE8EB36F1436F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1..AQa..q..".........2...BR#b.r.3...$.'...)..C%7gw..(.S.W89.......................!1.A.Qa.q".....2...#....B.t......rc.$%67Rb3s&'CUu.v....S.d5.V4T.e.............?...?..Wj.e.e.......w/..E..eOw_.....6......u..C6h.,..;.g.D8Z..-)O..jy..e;.u.g..w..[.L""k'w.......'1'.[......=..P...S.9a.V./O....q=8xk]...........9......F...e9'....9.O.... .&.....p......c.4...mr...?.......L..'.....0....+..|_...POM=7.?.2.a....};.Z..y./....>./.C.<...;.....|.1>...........S.8.o.O...+..n2...k../.X..9...Y...:.....\...Dk......q.K..\.Wuh.!Z?.mu...R.5.A.S.h.0..[..v..+M.....aUi*.k..?#..._...X..R.&]..[..;../]L..f..V......*.e...ut&.#.J.5....c%..o.$..v.<K.6..T.IP.....6X.*.uf..t0^..-.)m$.!.q(.j.f;..WB6.b.B..R.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005V.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.349090324395828
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:1Csm/6oXL+tSf/EvlLbqWXMAywW9BUxpyW+rdMr7k/G/EqFXM8L9a9bWTq9RGYH:1Csq7+0/EdKWXZW9CxERM7E4j8
                                                                                                                                                              MD5:43AD51A9FEDA31BA2C67A11C8D2ED41B
                                                                                                                                                              SHA1:BFDFF7BDD4D4892A6C5B90B268817386A6E3420F
                                                                                                                                                              SHA-256:35554B3CB70D2FAC99D202D53AB74FADE066D400E09A0DC3E5864ED0AE9E04B1
                                                                                                                                                              SHA-512:521064A8C00E547705EA670D8462BDB56C8F4DD8884A3F6700AC57B60A031CBD3F81EF0401551C69C00940CE7031CD4D0C133E6A28691578BDBDC76E2ED4BC0D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ..>.......>.....)..^C..~..>.....)..^C..~..>..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............z.a5...$S..@.......N...^................8Zan.fF...9..........f........................................I.qk..B.....LZ.............z.a5...$S..@............z.a5...$S..@..............>.......>.......>...........................................>j......>T.]....>.......>..B....>H......>..B....>..>.)..>..J...................;........4...4...4.."................>...>...>..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4...........>.......>....#..>............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000060.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:06:24], progressive, precision 8, 38x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):22203
                                                                                                                                                              Entropy (8bit):6.977175130747846
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:5q3R1VBvq3R1Flrk6Q0QPJJrR39joOVMJ25d1NkMhIwobbtAAAqYnLJZMJYZ2AC:xw6Q0WJR3FoOVMJIIlAAAqYnMJdD
                                                                                                                                                              MD5:2D3128554F6286809B2C8E99DE5FD3F6
                                                                                                                                                              SHA1:FC42CB04151D36F448093BDEFE33031A9B8D797D
                                                                                                                                                              SHA-256:14FA2D16310485AA1CE41F6D774A3D637E8CF8B03C4F72990155DF274FDB6BD9
                                                                                                                                                              SHA-512:D8531247A6E89ECABEA9C4A78F596CCE3493334EDF71AE4F7998FDDD0F80705948609C89756AB56FDFAB6D04DEC5F699A693801A772CA2EE2465BDD2CE5D2D5A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....XExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:06:24............................&.........................................................(.....................&...........*.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...H.....Go.Kxn.b..g...........%?_....O......q......7G......%%.V..8zm.].v?...jJ~._..>.......O;........o..rI.A.....n.a.........

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000061.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.458908846002042
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:dsMcEhltxyMtMg5E15LNdXqi9VUOF6pyNrdMruUK2FXZ79zkEG2y9BuIOg:dsixyMqYEDrXb9m46gRMxWM
                                                                                                                                                              MD5:28BA1A1545CC20E73BD0CBF22CFC0E6A
                                                                                                                                                              SHA1:07211C69FCCCED578417858A27B0AE7FAC3D5C71
                                                                                                                                                              SHA-256:EB0175BA0D81954523B7DA89CAE373F26BADBF9177F406F4F4AA137C11F87E53
                                                                                                                                                              SHA-512:34CA42B1CABCFE6F9ED537C426471336B8F802F90754B6055B7214C77959310081CA94851CF658C7F004AEA535543E04FBE955B045215E3EFAA1F50E3DB21548
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......l...v...`...................................................................................................................................2...>...H.......v................................I.......I.qk..B.....LZ............\?..+....l......\?..+....l.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............$....$.&.C...G.....N...^................l..8._A..B.............f........................................I.qk..B.....LZ............$....$.&.C...G.........$....$.&.C...G.........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4........................#...............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000062.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):15740
                                                                                                                                                              Entropy (8bit):6.0674556182683945
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:Elv3GG8/OOs+GouFdxMlxjoPyerzkpuOo2vPMc62PaJseZC+BJoS/:EtNiwdxMlZoPhzkpuOo2PMc6rX8+B6+
                                                                                                                                                              MD5:FFA5EC40DC9A0FD10EB9E6355142D6A6
                                                                                                                                                              SHA1:3D3D6A7E086B3C610C08F1F3E3F883604F06F2A4
                                                                                                                                                              SHA-256:D74C3973C8D1F7C77274691AFB1AA934940674341D7EEE563BE75E563281BDFD
                                                                                                                                                              SHA-512:6FAF2A24D06E6008F3579C7CEC90C2887462BDF83FAD7372FBB74B8DE90340B580E9836F309B68A9794597A598F7DCDA661C9A58DA6D8187C69083B7A17C9CD9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!.1.....AQ..aq.g..8...."r....2.FG..#.E..7.Rb..Cc..D.v.B..3s..$d.%5Uu..&6fW'w........................!....1Aa...d..5e.6.q...Q..."2b.c..r3DE..BRs4U.#C.S.T............?...u.&0...cV.T.I...1..=4....Ce_.g.q.=F.M:>)...k..pm..h..=........S....)Ja8x...b.).=5.q..0......k.M.....1?-.G.b&.5..Ep.8t...'...R)..ta.F$bXO]tW.b.6#.t.XWN..ZW......].....G....x&&f..'L.....7...\...'.8...~`.sa...............................................X........qo...SMk...'.V...i..hb.}&?/.k.:>l.^....>Y...<}...&.jY.Gn.MKejyV......D......gf.0....t.nw..XQ...H.B.....=8.UkR.....Hm..w..]...k...#Z...F../.gjWvf.....w.aZ].2..5..^...VZv..._.7..a.|...:.B...,f...............~....m.;_.....-.e.y.w.[m.].bu.b.f+.E++\.....Y..7

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000063.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.3400208087316114
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:RZasYkZeGjwXtWsS/EAkLoEjgjWXLgjW9DNUCpy5rdMrEkurFXOZ3pdl:nasljwXyEjdPX79DOCERMEkc0d
                                                                                                                                                              MD5:2F7FE559259F4780097E31A2FC6FDEF4
                                                                                                                                                              SHA1:1E87DB33BA79CD237CE9436208A3082C3EAC726B
                                                                                                                                                              SHA-256:7F8D6899890DE7363A560DB331871ED2723CF386F55E4671811A15516B1FAF4F
                                                                                                                                                              SHA-512:B4AAEF4D74AED47C9A27101DE81AE079685A2B4B29037799A6B9D8509444C470C79BA1FD56CCED60C4D09721904D5E82C5434DC433E0A6AC2EBA9DAFF2514457
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZK;......K;.kl....j..'..K;.kl....j..'..K;...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............N..Zk._.8d...m......N...^...............kq.A.nFN..T..4..........f........................................I.qk..B.....LZ............N..Zk._.8d...m..........N..Zk._.8d...m...........K;......K;......K;..........................................K;.j....K;.T.]..K;......K;..B..K;.H....K;...B..K;...>.)K;...J...................;........4...4...4.."..............K;..K;..K;...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........K;......K;.....#K;.............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000064.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):86187
                                                                                                                                                              Entropy (8bit):7.951356272886186
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:AbmHwD7za0syWMetp3TdPFzoJamVdAQZCiUit9qbYN6LerhWMzIWgN1EeaYhJM:1QnzsyTeP3TPAdAQZCi5qbYEKrhWWMNO
                                                                                                                                                              MD5:FEE4785DF76E93A9DC2F4501CBAEAE12
                                                                                                                                                              SHA1:8FB4527BDE05EF208FCDB168098A07707C27501F
                                                                                                                                                              SHA-256:F091DED5E283AF6848670A3172E7C43C6099875D39B3FC69C2BDBA914F609602
                                                                                                                                                              SHA-512:7E99D33151A0D3873D6A819C98EA8E62D928C087B7BA2080F11C7BCF746AD60A44D4FF6EE3D2D2E8DFA4BF1FC6285ED56BB83F91C2FC6FC4FDFF2000105F10B1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................1.!Aq...Qa."...2..BR#...br......6v.7..3.CSc...$4.s..&dt%u.f.......................!1.AQ..aq........"2.B#....Rb3..t.5u.67.8.r..$....C4.cs.Sd%.DEUe&.............?............w.....c.....i.A.....3...7.......7..P......%.........?Th..l./?.;.....$}..=5Oa...F.c.A/...D.D..]..y..3e.5\%.fo2.X.*]q.5Ee.}..i..md.T....#...-...Mu...9...-+..~w5O.);..G..'.;..).....A_...M.vV..y.q......,<.3.(...._K:..XM.......w.......9..T.......?b..a-%.c;.}..>....|.,lZKCEB.t...fw|.Sw^..Y..:.J.................t._P..v..j.1.R8.R....G..W*H<(Xi........i..xcu...WM.dqM>'W..g....M.q.....+.....b'..~....>..T.~Jc....fj.X.x..9...N.w.6:..>.......&.(h..u...t._...)_k#7Za...cZ....P...Y..;.V.,..xo.....f........Y...\6...M'L._

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000065.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.6664389492795415
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:eGKstOUIstgrLEdzbULIBhrZXw9EyUqpyFrdMrSvFX2h8rEq/xj:ssRIsKvEtUOJZXw9SqYRMQgh6h
                                                                                                                                                              MD5:D0838A22EA1D427948951A6DAD04040F
                                                                                                                                                              SHA1:3F8883F836D858DD519A2803CD8C2090DFE1753A
                                                                                                                                                              SHA-256:9180A0BC8DB3F8B6EBE922FCA6D0F30DCD56B9156F6A10030BECAE687EE30059
                                                                                                                                                              SHA-512:E833FE522CFC79A55B64AD7DD352DCCE1F740BDD0DE6BC2819ED9B29CCCD048E54ED9C31B9C651ECD84AD5CD6CF4082E88B83DA3245BFA38B85E951C09AF278B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>...........v.......................................................................................................................................2...>...t.......v................................I.......I.qk..B.....LZ.$0......$0.Z.......#..$0.Z.......#..$0..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............,Mrg!H....V".......N...^...............5.p...D..r....|........f...................................H....I.qk..B.....LZ.............,Mrg!H....V"............,Mrg!H....V".............$0......$0......$0..........................................$0j.....$0T.]...$0......$0..B...$0H.....$0..B...$0..>.).$0..J...................;........4...4...4.."...............$0..$0..$0..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4..........$0......$0....#.$0............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000066.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 85 x 470, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):11197
                                                                                                                                                              Entropy (8bit):7.975073010774664
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:p9wNdtRKcVHso6zsqm06xaqZdingVzLZ7/PGSIz/yycRTbChh/JzhbEx15RGb:mdtMcVHqgAqTinMzLZ7/uSIz/yTR/mhF
                                                                                                                                                              MD5:DDC3CC30794277500EFE4BC6667EC123
                                                                                                                                                              SHA1:EFC9642C1F95B5FC38764476AE481649C016FA0C
                                                                                                                                                              SHA-256:7F5B660A1A0BF46C75AAF19B4F77A0E086DE003EC03AFC1F58D871D55AA5BA9E
                                                                                                                                                              SHA-512:25232A84604C3959634D33090238FEC8D51E40AD84EB3A08BB8522A81BE1E83378649C014E98E1DFCDF46B7BFAC92D8D2429211CD11D7EE0334C9C3DF7C1B6A6
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...U.........1x5.....PLTE....................................e........................................................s...............x..........................o..............................................................................................................................................................~.............................m...............................................j...............................................p.......z......................................................x..............|........................................v.......................y..........................................................h...........................................................................P..{....bKGD....H....cmPPJCmp0712....H.s...(SIDATx^.}i@S..N....h...!..)....AI%..p.L."a..)..`U..,h..:O.b.:.j+.Z).b..zN.s..{O...&|..N}...${....~.....k}.[k}{.o^.D_..W:35ly..7rL....6n0.A...b

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000067.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.301571098980443
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:qsu3Ecny28vm1ElTXj9m6URMLseEEf/DGin:qsMy287lTXj9JURMLsl
                                                                                                                                                              MD5:9F29254FBCE2A1FC2CE7473ABDC6D56E
                                                                                                                                                              SHA1:6F0C68BAD1E14D2F05A5ECAB0FF06766364CCBE9
                                                                                                                                                              SHA-256:966F9CA0423EC79F984F4AE342E6D0D2A0D3B3B8231465B6D9EE49F2E6AA7806
                                                                                                                                                              SHA-512:176A270845053E6902EF694424EB66578E5DE501F25F3E49A2A1568B84C912C63713373C3962EAC3077B286F5F96DF1F022B8BD12A704C9EE59DEFC77D09AC41
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ..1.......1.\...*D...K>..1.\...*D...K>..1..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............X...a....l...a.....N...^................^..!.H...2...........f........................................I.qk..B.....LZ............X...a....l...a.........X...a....l...a............1.......1.......1...........................................1j......1T.]....1.......1..B....1H......1..B....1..>.)..1..J...................;........4...4...4.."................1...1...1..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4...........1.......1....#..1............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000068.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 88 x 574, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):19920
                                                                                                                                                              Entropy (8bit):7.987696084459766
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:DRSgtAxJx7bzvAsVSqQElOT4uHmpmvNYT9aPU+QtsC2LgfIqJZnbeyRB:DsgaN7bzvAsVdK4uGQFUZ6bU/p3
                                                                                                                                                              MD5:1BDAD9B3B6DE549162F9567697389E1C
                                                                                                                                                              SHA1:5D9C09159F07A3A9BDCC6C4B9BD9CB72D0184E6F
                                                                                                                                                              SHA-256:0908A4CFA23F93011176D47F45843E9CA2973030421996E8E27484781F54B0EC
                                                                                                                                                              SHA-512:475040779AC247BB5C3E11862FB55FBDDFA12D759EE86A33E11BC1F3B656D6CD0F9B25146C0113E43E1D8001D8867D3BC3BF7E6FE21F3A0016CB1F8B70B7A15A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...X...>......y=h....PLTE..................................t........iw..............................................._n|...Tds...ky......................................................p~.....................................................dr.................v.............................................n{.......ap}..........x.....z...................u......................|..Vfu............r.....w........................................~...................Zjx...................................Yiw............w..|....................Xgv{.....y...........................jx..............\lz.........}..z.....t..[ky........u..y.....gu................................{..........}.....u....................~...........y....r.....bKGD....H....cmPPJCmp0712....H.s...JfIDATx^...\.W./.}....Sy...(..4....D.-.....H...% .$"D.Qr.......`..;...6...N......s...^...L.....Y{.GQU`..~...j....{...-Ax.K..&.....F..I\i..

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000069.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):2.919057202551492
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:5s1lIlzOOM426DstAoSzvgE1Lx9NVSL6MhwGcXeSc9ndsppy9rdMrHgmHhFXtDhc:5s/appIqX4E17N0fwXg9dgARMHRW
                                                                                                                                                              MD5:5820390F951A84E6CD56E61B309285A0
                                                                                                                                                              SHA1:6F562D5259562C65CD86AD3950B76A97759E5757
                                                                                                                                                              SHA-256:47D90D1BAB2019399DF658EBBBD5964113A99D8AC77578E335A0DCFD4D7A65F5
                                                                                                                                                              SHA-512:2356CE54AD14B7C416F1F8513E7ABDEB41BEE44085C64A9B647AA54AFEFD40429A4B4B2D41EFD85163CC61D453A66134E979179334F1358B7E6C8944D910E6AC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>...........v.......................................................................................................................................2...>.......H...v................................I.......I.qk..B.....LZp.......p.....j..k.....p.....j..k.....p....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............!.!X....$..3.......N...^...............O(..`..A.:.....6........f........................................I.qk..B.....LZ............!.!X....$..3...........!.!X....$..3............p.......p.......p...........................................p..j....p..T.]..p.......p...B..p..H....p....B..p....>.)p....J...................;........4...4...4.."..............p...p...p....z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........p.......p......#p..............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006A.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):179460
                                                                                                                                                              Entropy (8bit):7.979020171518325
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:oiKXvL7lv0am/R1vrdH+9dK6zPQ6bbnGDpcGGDNMIOIMAT8q9Vc02Q57S4A+vMFz:+vlvC/HvgA6fGqGGJlO1qZ71W6CzDn
                                                                                                                                                              MD5:4E131DBFEC5C2462273CA7B35675B9D9
                                                                                                                                                              SHA1:CA037F444D819A118AC37D7AA3782B9BF94C1616
                                                                                                                                                              SHA-256:2A4A3530D652E227DDD5ADC096A95F6034718F7C380B07DB622022D768815059
                                                                                                                                                              SHA-512:C333ECEB1439D0238BF44FB7896E62DBA4C645B70413AA0F99C1F10E8DCD20C2EEE5C83F2E9DDE9A2494C85A6D8D13CFFFC4160E2F598E17867015F5244D656A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!.1AQ.aq...".....2Rr..Bb..#34.....CSs.$5c.t....%.Dd.6.T..u.U....E.7w........................!.1A.Qaq......2."r.3....BRb.#4......CsSc...$.5..%.DT.t67d..Uu...'............?..c.......p..z..i.....z......kj........F>f......3N...M....RM.&..-.~.Q..'.....q.a..w...-~......g.{..&.......V.n.D....>FS!n.....@..)...W..q..Wr{..J.gf.{.M$.P@m.,..9..&m.D...w.._...-.O........s.....h.k~......(.K...V..l.-...+.9.k......*......#.p#.O..9M..mF...C.......7+.AI....4vw.;..H......e..Q.u[.eUK.....z.....[.Kt...s..Lf.4..l{.....sh.............=..;..iqkj.m.a...NH......v..H..$..q.y......c...U[Mcf.......+...S-...^....4..T..YtL.x.v.;.....<...Ik|B.$.s8......3.+.8.l.. h.:....%B..W..I.QRS..,*x.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006B.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.354865552585995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:CsNieKNiTYtAYFd+3E4+ZIXAwFKFI9Js+py7ZrdMrWe0wrKkjFXUIXQ/gQg:Cs4ZN2Y1F6EcXNFl9JLiZRMWcrFj5FQ
                                                                                                                                                              MD5:DA39C45F0CBA94F9D41991786675387D
                                                                                                                                                              SHA1:E3768F3279D9807D3EF446098808B332CDDF7797
                                                                                                                                                              SHA-256:F4F3D25D9BA0248E02A10DD3BF44624ADD2AB18D71D8AA117D45FE60625268A3
                                                                                                                                                              SHA-512:BF0727B7AD2E7F69AD186040FAB212FC0E8897CDF33559DA218893ED7AF90107C7A5D0A3B3BF6C0467FAF7457293D7EB0A7B5D9B302F93718AB05EC7A429C0AE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ@.W.....@.W.y...*.....|.@.W.y...*.....|.@.W..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............c}?#.;F.:.weW....N...^...............).....O......Y........f........................................I.qk..B.....LZ..............c}?#.;F.:.weW..........c}?#.;F.:.weW.........@.W.....@.W.....@.W.........................................@.Wj....@.WT.]..@.W.....@.W..B..@.WH....@.W..B..@.W..>.)@.W..J...................;........4...4...4.."..............@.W.@.W.@.W..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........@.W.....@.W....#@.W............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006C.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):109698
                                                                                                                                                              Entropy (8bit):7.954100577911302
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:rDlmvIWr0aRtNCfShCWBxyCHMlcVG0Ezy4FR:rDliIfot8ahCWBcCHDVwR
                                                                                                                                                              MD5:8D804A60E86627383BED6280ED62F1CF
                                                                                                                                                              SHA1:E23FF14B10AD0762DD67FBA3CD6EFC85647C0384
                                                                                                                                                              SHA-256:494547E566FB7A63DD429EB0699FE41AA8998F8EA2F758D813FE3D56C3075719
                                                                                                                                                              SHA-512:0FB19F3D00159F2748C3A54E952E551B9FEA6910D67A54DECA8D099992E50383EADB92768FF1F75CFFAE82A7A157B1E0F77A2F0BE7EC64FD2324304FDCA46577
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...............................................................................................!"#.123..AQB$..aq.RCS...b..c4%..rs..D&....5E6'..TdUte...u.....FV...7.......................!"..1A2B..QaqR.#.br3.........C%...$5.....c4U..Eeu&SsD.6T..................?.....O.C.....^..R<A.g...[....3.....r.0.....nX.S....}...[.?Z.....A.?..~~I..rY|N.o...9......!...o7r../-.y...'5.3.U.s".-.0.1......SS...&.Q.j.*.$m.e..:x....`}...EP.?.7..~G(so.......O.....z.N..<....~^a.e...........p9.?<._..|......~.<@.D.9..G..?.?z.y?z.C.U.w..[.,..A.+........s......g...G.^....pz.xY.....d8.y.X...P..O(A.O..~:._.......<...o..4s..^.^b..x......_a.....|{c...:..X.....}.._...[?..NK.c...}.<......H.G....+x.Z..|....n...o....`.nk.#.%x......-|...|7......N!=././..w.8x.".8....'x........w...,>....j[w8a..}..lS..?.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006D.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):4.320625950701689
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:CsyzDnSGrtO24E3y1ZXAAv9UesM7pyflrdMrpNFXgRep/qJ:CsWSeIEgXAi9Ue3YRM7T/q
                                                                                                                                                              MD5:315B4A77F76EA8AEDE6FC3788646F226
                                                                                                                                                              SHA1:24005D1A5303DE2A4C74BD4B274CDC8184770369
                                                                                                                                                              SHA-256:88E51B86F8F8C414404C52464894D1C07424726BAE7AD97EBE645FA27EECB863
                                                                                                                                                              SHA-512:EB68405E3C6BAB2FACC97023D0FD3FC90777C3B3E741FDE7B0EE55D10684D6D9B1840316435D6168C5EBF8D4D26D082FF4AB6B7F12BD954CF3C28CB3DF82E7D1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v...........................?.......?.......&.u......I.......I.qk..B.....LZ?.......&.u.....?....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................../...1.......N...^.................'...kE.R.T.e7.........f........................................I.qk..B.....LZ.................../...1................../...1............?.......?.......?...........................................?..j....?..T.]..?.......?....B..?..H....?....B..?....>.)?....J...................;........4...4...4.."..............?...?...?....z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........?.......?......#?..............................................

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006E.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41893
                                                                                                                                                              Entropy (8bit):7.52654558351485
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:pZvVQkUbOHxx3pvVmO5rsP5gUdXwFMuv53knzyncaXgRDqPU:pZkijV5wScXwFMYknzucaXgRyU
                                                                                                                                                              MD5:F25427EFECFEE786D5A9F630726DD140
                                                                                                                                                              SHA1:BC612A86FF985AB569ED1A1EA5FFC4FDB18FC605
                                                                                                                                                              SHA-256:5A36960DF32817E8426BD40A88F88B04FB55B84BAEF60F1E71E0872217FDB134
                                                                                                                                                              SHA-512:B102F34385196D630F198667E874F25ADBC737426FDAE0747EC799B33632E5DC92999C7C715DC84D904342738930267AB1709870BDAA842243E4C283FE5E1554
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................!.1AQ....aq......"......2...Xx..9BRr#.b3$..&..g.8....%F'G.(H.Ss..D5E..v..W..Cc.deu..7w.h.).....................!.1....A..Qaq...Ttu.6..."R..5...2B..S....bcs.Dd%&r3C...#$...Ue.............?..R...%.R...t.MQ*.l...v...V]..n...Zw....M....4..F.&&bb0.:]l......ay.r<..3.l.Q^.........I54.N2.8..2s...w..r6.......[1Zh....O...9..>...B......x]...r.\.\..v..~....y.QT.3.......=....r..}.l.....o;....M..C1....w)...+o1f.]...MoA.E..s5..i.\....miGsy..m\.Zj....I'YU.\tU6La5v.>.K..m.]1.......k..0....</5v.V7lY.e.vV.+./[....f..u{....s.}.Rb.Z.....Y.6]..m....V.\...Mr.=r...K...l..%..m^.......X.(..fG..[F*ly.jL.a4..vs..o.e..q.9km..w1.yg.....r_.*h.n..5i.-.{Y.l...<...'Or.s..Z....../JP.....\FV.S..............m

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006F.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):3.310894096322658
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:iMDTdsdOZU6U4MJWzkYKtrZCrBJmQEtaDsNyEZVbsPJmQEtaDssDEZxlYJmQEta/:iLd2U6HiWzkY8jGEDbPUErl7bW/FMc
                                                                                                                                                              MD5:8C3BE8826663D07FA839D75E1F84762A
                                                                                                                                                              SHA1:8A6B792522DDAD2C4999E69687124DE97BE61196
                                                                                                                                                              SHA-256:D4AC576300E757D7F382F4C827021A682456BF6645B5BAF98306FAB5F68CB81E
                                                                                                                                                              SHA-512:82D022B4D40ECD066E53622BD5E57ADF8E1CA46714274A1D4DF8573942343CDB046DDD44AB202D72E8EBDA7E74FC36A4CA44ABA2A21C074B4F4F0BB585560453
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........$...........t......................................?....................................................................................................\........................................K3......K3..=\.9M+.|.v.z.6.....z.6tO...?g8...z.6tO...?g8...z.6.....'.........F....K..VO.(C.s..5..UK..........................................................................qT&h.....T(T..K..T.<.......{.....X.........7...............$................4..(.....x.(.......q.......q..CNO.@.g8.=.............'..........2...v...........................z.6...q.K............................K.......z.6..c..,0...e...B4.$........[.-...I.......9.....................................K.Y...CPK.......K..VO.(C.s..5..U.K3..=\.9M+.|.v..K3.....u...Ta..<.G....K..VO.(C.s..5..UK.......>.......@...........'.........FK..VO.(C.s..5..U............................'.........F............u...Ta..<.G.......q..........c..,0...e...B4.$..............E........................................0...........e....4....

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006G.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12288
                                                                                                                                                              Entropy (8bit):3.856787794897635
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:ZsuOJH/vdCwLGXsAT7uNRzJ7DVrbV5aZHx9JE0hcf:+9jU9+RzxwNn
                                                                                                                                                              MD5:751978209AB7523204B86060F21516EF
                                                                                                                                                              SHA1:0B22266A792DF2714634E47AEDA048369EA754C7
                                                                                                                                                              SHA-256:E874CC7F11AD6994396D2EDA6F5359CFA06FF18250694117B6AE90DC27858A14
                                                                                                                                                              SHA-512:C2DB60D604BE7F45136E233A5C7A2B3ABAEE6C3B416C669DC672056CC2AC24DF3D7A3F58EC3F619B44CF207812C050937BF678E0795D63B9B0AA457A2E1622A9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>...........v.......X .. "..2...>...d...<...v.......@....!..............................................................................................................................................;......!.."....o...I.......I.qk..B.....LZ...!.."....o.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............D.6......Q...f.....N...^...............,ro@...C.T2.L.* ........h...L...............................D....I.qk..B.....LZ............D.6......Q...f.................................................................................................j.......T&n.....................H.........K.............$...........-...J.....z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.5............(...#...8.....z...,4. .......$>........4...4.@..7.....................D..n4..o4..p4...4. .F

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006H.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:05:55], progressive, precision 8, 612x618, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):68633
                                                                                                                                                              Entropy (8bit):7.709776384921022
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:tapXpSTJDOkFGdJdBk/slsbfsw1imaapnbvD8:U2OjJr6b07m1bvD8
                                                                                                                                                              MD5:41241EE59AB7BC9EB34784E3BCE31CB4
                                                                                                                                                              SHA1:98680761A51E9199CF3C89F68B5309FBEC7EE3CB
                                                                                                                                                              SHA-256:035B26DF61855A3F36DBD30FDAB0C157C04C9E8AE2197EA4D4AEB3E82E6A4C2B
                                                                                                                                                              SHA-512:3EE331D5BCEE4AD5D3FC9661D4AB4053F7D351591A094334F963C33C9D0E32CCCABE9334AD7C308108CE99617E064FE848DCD469ACD8D83FBE5C4452DE523D8F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:05:55.............................d...........j...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?../$.W:SZ./...9.....-...u......r.....].c...@W_.7...+......v.+PD.I..-<1.pDn-\.....p.$....0.}V....\..>.~..XN.o..l(E....ik..o.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006I.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):20480
                                                                                                                                                              Entropy (8bit):4.091690918733447
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:1bvLIyTVGGJgnM276zSlyvpp/SrFSXOpqew9g72B7QpXK/OJ807/RJeXV/Xg8imv:xvL0+p/kJ8g2B7QprRJCqmLz7O
                                                                                                                                                              MD5:3EF77893A9C5E6DEAA2D05A668B91484
                                                                                                                                                              SHA1:8887F6ED40BA4077A939EBEA4A088F590CCB2CE2
                                                                                                                                                              SHA-256:188CAA159E70268AD077212719E23B27DF90E967F3767881209B0BB142437880
                                                                                                                                                              SHA-512:5D36892A268E0B733C24050950F33DE25498CAF36999AB7CFE2A0D73881C7B5BF71A5706BC6F2CF27FC25EA050124C2BB5F4FA9B47C8A82D11AA15EFD7AEEF79
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:N...>.......L...d... .... ...9..N...>...........d...h...@...@;...........................................................................................................................................I.......I.qk..B.....LZ.........../..c...."p$..Y.h4............Y.h..../..c...."p$.U.....I.qk..B.....LZ.I...........Y.h.....Y.h.....Y.h.........................................Y.hj....Y.hT.7..Y.h..~..Y.h.....Y.hH....Y.h.....Y.h....&Y.h........'Y.h2Y.h..z...,4. ...."......$>........4..`..7......L.o.w. .P.r.i.o.r.i.t.y......................Y.h:Y.h.Y.h..z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.2.3................z... ..$........................................2..7.........1.h...?.......?...?....rA\.-?>...o.u.t.l.i.n.e.L.o.c.I.D...o.u.t.l.i.n.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.4........?ff.A......'Y.h%Y.h.Y.h..z...,4. .......$>........4.@.4..`..7.....................D..n4..o4..p4...4. ..1.......Y.h*....Y.h....%Y.h#...'Y.h&...9Y.h....

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006J.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:08:07], baseline, precision 8, 595x450, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):59832
                                                                                                                                                              Entropy (8bit):7.308211468398169
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:HS9SYFtN0+CRa9mfJy4zBAiIJhzrkHDV2hJK:yAmta+Tyy4zBIJW5WK
                                                                                                                                                              MD5:DCDD543A4E0BA2C1909BA095D46FFBCB
                                                                                                                                                              SHA1:B86C89537138FE07255354202D3EAD0B53B3C54D
                                                                                                                                                              SHA-256:28F334B77068F71F5F92A95695433B950610204A0E5580CE567DB8FAD4993ECB
                                                                                                                                                              SHA-512:5408C3259B7F3288A4BEB04342799AD5FE3A6F0EC7E92353B29B7E7E538DFA9903B39637226919E0421BC422635D25F5F8069DC7441864DC03E1B909BF5C2C84
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....fExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:08:07.............................S.......................................................&.(.................................0.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................y...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?......;R~+'....xh..~.n-}.......Te................^B..IU_....._...S......h.......!....9...A}6V=J......C..c.....Ug.Wh......

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006K.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):20480
                                                                                                                                                              Entropy (8bit):3.2468813876560763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:f3FEoyeUJRt/PkgGekdQ/7RJaSKJoig8g:f3FEoyeUJf/PkgGeoG7RUSKmig8
                                                                                                                                                              MD5:5E3DF6DFDDD49F519FF4520A09D2A20A
                                                                                                                                                              SHA1:17D0B2AB463D85F7EBF35455D5E460406286C4C8
                                                                                                                                                              SHA-256:D8452DCCF0D416DB184A7BF34DC130DDE096D317BDC015C1A21F0D635548EF9A
                                                                                                                                                              SHA-512:8E4AD22FBC68D832E3DB12ADB84F0D3DD87891E81BBE30D5BDD3541833EF42727560F76B35698CD9E83AF78B20A64B682671C76ADC527757D618D01B37FCF1AB
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2...>...........v........ ...-..2...>...B.......v.......@....,..........................................................................................................................................#...P...#.....[.0c.I.!...I.......I.qk..B.....LZ#.....[.0c.I.!..#....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................eY..v.|........N...^................u"...@...Jq.r..............................u"...@...Jq.r..........u"...@...Jq.r.............eY..v.|.....................................#.......#.......#...........................................#..j.^..#..T'...#.......#.......#....-..#.......#.......#.. .L......#..3#..I#....z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.6.............#..3#..9#....z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006L.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:modified
                                                                                                                                                              Size (bytes):53259
                                                                                                                                                              Entropy (8bit):7.651662052139301
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:dCiCBBenRYWDBCipMYGTbYGLHbXxoP/qEF+MU50qyJ30h2W474S/Aq/xc4674bi5:dCiIQXBCiwbDLHD0/sFyVel4Pi4UgE
                                                                                                                                                              MD5:2EE369ABB7936F8C28FF0ABDD224EA05
                                                                                                                                                              SHA1:FE9D304A7B49E31EAE439369ABC548E265149636
                                                                                                                                                              SHA-256:FB12D59B8BE911247BBAFDD416852E8B74B028005A141CB4DBBBA109B4B6ED2C
                                                                                                                                                              SHA-512:5CF396CA472C32AE988600176114106CB1619404DD899A3867A5AB43DC90583B771EF69B14EF50E56A21F038BF51D8463C6ADD2DE9D4CB523F6290E24A4DECB3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..AQa....q........"2..R..Bbr..#S....3$.....C.4v..(X.DtEUV.....cs..Td.5uf'Wgw8Hh........................!1Q.Aa....q.2...."R...r..3.t..U...B#S.4ub..C$d.5Ee&'7c.D%sT..............?.....?...k,lk^...M".Yo5.Qp.&s}b.m.:...W.x}.*.a......N1..d-n.-..^..b..TZ.W..."....F....^......ve5...^...2.:i...........~u2pK.z./&..u..L[I....Y....@y{|>..MN=:....Q[..H....a........|%..4fV....).....^.9b.f...F...p.=.W...aZ.........Z.t.n.....z3..[..lVh..\.N-.._.sK.y.._e.G.jig.a.7^....u...*.p.5.a.].........u/u..D.yl.XA..f.z..~.x.....N.....b=.uv.2.t.'.N.-.H..n.v.a.A[.Z.....T2...._...:....h..l.E..sm..a.3I...RE...fWb.Ek.0.#.)..Y#T...........u{....U....s.].7_H.2.`O6...P......}..4LR....]4.mid...

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006M.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):2.4769669674063746
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:Nw/aQUW0L2MMR1edCDJt1Ulzvr8POVCUl6jmgOYYjLSIUluLDibdUlipbScrLKgv:Nw3C/MR4dCelz/dlbLGlWuGlyhUl9aq
                                                                                                                                                              MD5:AAB8A663E2B337ADDF17C189518A3944
                                                                                                                                                              SHA1:F954A55D1B1FFBC3259F8569065B98B91085036C
                                                                                                                                                              SHA-256:821A94E5E871E007FF3AF57D2990BD22FCB10716DB07AF7934727DB6DE90D172
                                                                                                                                                              SHA-512:50B9BAE064A9A950C70711B5A5FDFC225409BDC9EAA507CFDE98AD86E98CB1F34F4D8D499DB8469DA1A2392E8EB05448495ECCF738F9BA00EC8B3F5783FDF99E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:...."...................................................................................................................................................................................................(.-.....(.-....}B..-.{s......s..N*L....9>.8.(.-....}B..-.{(.-.s..N*L....9>.8.s... =..F...W..(... =...........G.......G...................................................G...k...G.`.....G...1...G...A...G...W...G...^...G...o....................4..~...1...(...(.......C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.\.r.o.o.t.\.T.e.m.p.l.a.t.e.s.\.1.0.3.3.\.O.N.E.N.O.T.E.\.1.6.\.S.t.a.t.i.o.n.e.r.y.......S.t.a.t.i.o.n.e.r.y.........1.......S.t.a.t.i.o.n.e.r.y................s...c..,....................G...1... ..$....S.t.a.t.i.o.n.e.r.y................s...c..,0............)..'..K..?..6............4.......4.......#...Ne..G.......G.Q..H.$......2...H...........................(.-.s..4................................4....c..,....................G...G...1.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2278
                                                                                                                                                              Entropy (8bit):3.851343297413908
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:uiTrlKxsxxEDSxl9Il8uj38gylc3TF+Fi4OEhHbHmid1rc:v/YXjF+Fw+Hi
                                                                                                                                                              MD5:41AF6F1B122B16518BBA431B7EEBC1E9
                                                                                                                                                              SHA1:D65EC8F543932421F8851771F307B149060BBA05
                                                                                                                                                              SHA-256:DC9632F46774A6815F1AE72A55D1E3C8D4592C6EE670163ADABA1CAF05DCEBFA
                                                                                                                                                              SHA-512:367D9B0B1B8CD84377E7229301863B933423576C1713417EBD840E33C0A4B7F6063D0405D1E7F5CCD6239F96447033791A8D2C762C82C09E4B1291538CD5498C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.J.1.m.u.g.S.o.z.s.S.9.x.S.Z./.Q.v.O.c.+.E.J.4.u.2.c.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.D.4.G.E.7.K.X.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.G.z.u.8.5.A.

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4542
                                                                                                                                                              Entropy (8bit):4.003624978456441
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:zYT0NwJ4VpTIbVwT6/qCnb14th4A9l5I3xf:znZVTO/qC54D4QOxf
                                                                                                                                                              MD5:3B417BF6A00DB2884B054FCE4AC4F15E
                                                                                                                                                              SHA1:B083EBC6FB0ED56CB0B461F73BDD4F6FEFF854F0
                                                                                                                                                              SHA-256:928AE32D5F9C21D4DC3E9341816B33B6994D11DC00A45CEEA42E01A11A735992
                                                                                                                                                              SHA-512:C3C6226F8647563B8C1C9E81D937AB7BD0823AAC5CFFCA372BC9D6A85623E641E825438CB3249615DE6CFC5FFE960808983F11F86FA35721A48541FFB744A4DF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.q.Y.a.6.3.X.Y.9.b.4.Y.b.C.Z.g.f.0.u.y.E.6.v.n.x.e.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".f.2.w.2.+.a.m.X.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.G.z.u.8.5.A.

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\doomed\11719.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):39129
                                                                                                                                                              Entropy (8bit):7.9941917155442965
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:25oBDuHcSgwjgJ1AWx9u7EfldW6XafhTbbbBC6OxTKlFPsroUC1zvB3xO0fhCpsC:25oBD6fRk4Wu7EfldW0afdPANreZ5xxU
                                                                                                                                                              MD5:B56B2F91C948A0716F7FAFEBC8C088DF
                                                                                                                                                              SHA1:87AFBC194DA609FB742CE564D6E92B251907F40F
                                                                                                                                                              SHA-256:834652A8829F90E7678C160C8245D750B47C4AFC066BDB43A140968427E714D8
                                                                                                                                                              SHA-512:B8F293CF622A511F4B496F29617F9465AB9C54FA622AB72EB94E3103C3FD915E0F7A346A45B7E34B9A113BCE2A85A4756BE92A8B6B93B6B9FE9D3093D1D85184
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:l....~C.O...^.r.&.o'...9....DK.........7....K}..%\D..u..P...1i..4.~....b...`+*vwG......<.O...=.'..........;..}.E.G..Om.7c.(.xS.....J.%O...?S.......~...'..h..h..{..wz..K.....|.....]...m..j('....{0.....,..Ob}..-K.%....Fk..:...".t...m.%...]..tf..(L!#.nc.`.c..f.I.n.hR....%F.Z":....)g..:'...W3%..../._...A.....t...8.p...s..W..&B..;..2.AR.........u....$..P....U[T%z.....lu>.....>.dk..0..mi..R9..B....iL[I.[d(..Z.m&!..X..?....n?oF.+.9wj..iK.D...^.k..]p.!......8.=...P.^....|.....D.`.F...A.......;.?.....L>..m..:..}....g...L.=..S..rz."E..X.h.rU.M.H..<B.AY.q~...9.=...Y.'R..tA..`.<L...p|r...2*BX>.! .7!..6.E..C.4@..XUF.q.8*..g.i...4.P59.7..........>6....,...t&..4.....Z....G.U6....5H..w.&.....%#..V...9...W.y.....<-......<{...r.........._.......`../....4...8.|..|L..o.%.L.2J....S$..H...\.,~.....q.2..,c.S.....w........Xw..Bd)...)?y....W.8..m..9:..k.?iJ+?..."..4{V....F..m.<.h.Ot...B.Z...(....^......d..~eT-....VhL.R.].A7....Zk.#F..R..Rh....R.Dy*L....u...e..

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\doomed\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\037778A55E1B7E9BED3390289866D09402D6C913.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):9650
                                                                                                                                                              Entropy (8bit):7.983779676598023
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:hh8FR48zi7WP+ljUiVRyI6UygS/cMhQxZHF00sglxI/GNV5W7eBB9/di+:hqJOMihVgOTS/9QTHF0AxmuS78U+
                                                                                                                                                              MD5:FEF55A2D33D266875532123BAED5024A
                                                                                                                                                              SHA1:29769F19BAC46A562837328B7776791C36C7856A
                                                                                                                                                              SHA-256:1D9E334650DB5663145CAEB14CC489DAE00EAE2CFC932B21805AB4145090FCCC
                                                                                                                                                              SHA-512:3FB0E5EC1BEE26D5F229A9D068E465618F70F0978341657C1E66347338E0ABCAE529AD851D30C7439584CB467073C3C0D800DD39BB66E087A645F855D724797B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:t.C....c.....e;.+....a..D.%..Ws.F.$>.QD...)..fc5.O.P..5u..aiT.dGqZ..v4....P..p5.h......P9a..M(.....&.]..&.gvs:%...L......k.:.m}.........|....Y.....5J.hRB[...;.~:.I.8.B....$...v.,.......?.H .l.B~2....o..X..ZZ.....8.~..Q?@qr.A....D.,D..7.y.....-.<.c...i..+....Q....1.gN..hk.-.&|-4,..td.9...dy...H...lW..K.Y:q..`G....zD.{.h#.....&..........@..y..'.3p.C...Wu.f..Y...RiWF..)....'M~>....5...UN.E...O.{..q.f.....?.7.^$.W#..Dn.....~.d..R.....q._-.|.K..$/..4}.Inbw....E...ik]..-4.....3.*./.6...n..W`..."S..V.~m..D...+..*.W....._TcY,..Y.4....7...#..<;.S.IJW<[.?...{.B.`...j.r.0.1.....B../..o...IF...Hy.............U..xa.f..|Z..}P.....m....D.1....Rg....|..a..jl.....@C..L.Zu=/..8.;....k>..|s.[..g....zV.<.0...>.X......i...5...<...'.~ra(8.)...a....q.~.a..#...........9.1.......,..V.):.`.J.....=..e..cuIS.ml.uY.dI&..-.=...0....z....j..a.B.%.X."...s[.R.w)\......t....,.UV.7......tq.3'..9.\7......]...D.V.S.-\.;...D.?.j.(.%....Wx.....b..$.... .C..>^.....

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\0A25402A40000E9317079EA989FBDEAB10234AFB.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):14416
                                                                                                                                                              Entropy (8bit):7.9860938326447934
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:+VhZ5fmm97RdNiMQ6Cgvl/EzIcGuiEUVveEWdYq9+wkdKwL4fii++yWZ/SRjh6AB:khZRx9t7xCgszZiV2RX+wkdcfC91i+
                                                                                                                                                              MD5:25E683DDB4CAC25FA2AC9A2FDFC16739
                                                                                                                                                              SHA1:09A94D30B93666B135281F59FA4F67A2FF3429E4
                                                                                                                                                              SHA-256:C83E44BF27529DB34E906FD1724B532912EB397703EB8BB71EF6F0510504B91B
                                                                                                                                                              SHA-512:5BD4A0E6C7238157C7368B1F15DB33043B7ED68D3B5D32783ABD7E09C9C818F998DAC8EB8EFAC944F82602D6469EA2A2A0B6D1DC9F706366F07C8453C4DC74FE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:`.E>Ko..d-{+.A..f>V&...YU.a.o..}..fY.....p...uL(M.@`;...HDV.g...V..U.-Dv......P.Q......P.L0...J..je`[.c.X.g]...{.O....+{.}-O..P..8..~yBtZ.A..S....."u......b..B..Tu....-&^.. .@...A.....0./yh...Y..............#...7.]2t.t.p?..[jK..GYy.....4....>..+B%m..WB.lT_.c7..1.IE.E.V.(.H...RJM........%.~(.e..........e^...*et...w..y.........."..8.%...)..oW.KL...:.....A..W.`..%`.]v.]..F....U......e......0}O.........RU.O...d9|..6....2...^..L..[.4K.....8....!..0..l....i.......C2.~S8.Vyz.>.......g.|9F.+|..-.......zV;9.....U.B.....Ae.K...a.}L........n{.r#..g..C.Gv..o$....~X.......6..$X...n..D....n......;,.:"o..u....h..51.<.e.w.<..S....l...W.2..xV#).33.U1l...no.`.u.c..6_Y.......u.....WA.]/.y.B.1twt....@.z*K.....#...7..3.G./7....q,......Z^..$7.v.W.k.{...c. ...M=.k....'..bEF.9.>e...P....-o.....}.}.*9.t...!.h..y_........)...q...}2ai.\.cAT..........,!=.3.@..Zm......m.NCc.W...{e.......{..h......=.....v..}.._.@......o...7`....#..k.:..3.bt....O..m.m)..b+.......0.

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\0CE0F034E77EEDE612100CE488EE967637B58DEF.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10068
                                                                                                                                                              Entropy (8bit):7.982938546225032
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:/sitMw5yRzXLavlgQQTUpMo3yJ+pOaOKPbkGUxZ46114S7WROVa+:Ui8nazQi3sGOCbkGUX7WRT+
                                                                                                                                                              MD5:0A142F0FCB34D2B934DE87B5308D43FC
                                                                                                                                                              SHA1:019A4E278DD7F2D0D7D4F6DC9E690B5FAB237B8E
                                                                                                                                                              SHA-256:32C2A70BCC0C7F72D7C3AB56B4208FC06EA43BD2DCD309911E727E46D804B931
                                                                                                                                                              SHA-512:2C1DF0AE431E80FD9DA60203CFCA7AF558FE971E1CEBEB580EFA46542A7455ED9236BBEB2203A7C3BFC49DDD74396B3517807E4E23704DB09CDC4334F10F533A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:#........C4..'.R..O.........z..W...(...Z ..R.... .<.m:].(..$....y.7M....".."..YP....*7...%kZ....8b.....3nq.~.w).W..w...=B..hr.0..`9.A.Sx.*...H~.!.6T.X.y..[.((..wV@...P..[t..=.v~.5.z6D...(!.... .ZB./......k..vY..9wy.fd{.k.C.F..]..D/.!>...o.tgEy....gz.2...9..nx......u.?.y....74...u...fp2V...e.^,....u~6.e..`.|D$..o...Cd...m.Z\[.....$.e.C..(.2 .......&M..l......c.*r.p.A..-yD..S.S..T.7Yb.Z.+....c.'...\x..U.qp.1u#..@[.T.......t..f...ylX.n..W..(m...).H..$.I.........d...\....=.+......wh...W...(Ef>5.}.....h......;..>|Q...Y....| &.{ .X..(..0.(.!..#.?._8O7jo..7.nLC.j..lF.\....`.3..w~.....Hre(.bA.J.nW"Bnk....]...W.."..w.D...:..UAG..L.......LG...<.e.{.P.Q../..4N.....MM.2.......9hu.....`\~....}.l..Q...b...G..........?..g...I]....l..8`.,,...+...p..... ...w.".....j..vi._.!L..l.^........w\:..8P.\Kn.n4z......b8!/.....)..G.g.9.I....G+`S6.Q.N....\#.....a..........T.A@.4.....LL...~..^.5'...q.3.. .c!.r...a...x+N.n.v<..P%..oL-...-Z.w.{.....D..A................?.HA|..u.

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\0E22ADF4ABAC508C15FE8241CA5B0D2E6152A063.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):11675
                                                                                                                                                              Entropy (8bit):7.98606573408365
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:FglCZlSAXyvyYtvER490xBYfkmg63J5fmawnE5wuqkDBJd+KhfBuAT+:pZpXyvltk4KHYZJ5VwnEKuPBKKhZuAT+
                                                                                                                                                              MD5:F6663071532034D49D281D4195D4F05C
                                                                                                                                                              SHA1:DF29D23FA5BF315B5C4654270C6C82F29CBB5277
                                                                                                                                                              SHA-256:A70449CE82152B53C2CFC89B1CBD201FCCF5C58B406EC9AC784FBEEBF98EB0F7
                                                                                                                                                              SHA-512:B996FDC7AFAF8E9FAD9757427C32D022C8E9A3E111672CE99704E69A4624201ECFDC80480BC86364B2F9E4F901B6975575DEC5C6083580C437505E9575F3319B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.G..&.{....-......C..<k.k.ru\$.....oE k@P.?.[.o.3).....D.K`.....o......s...S6'....M.{.oEX..}..... ...F..L_)-..8..G._r"...p*..e....E..Hm....=...G.+m..T;..+")\tk... u.{z.H..C...c.q_kb..F.I{.\.[X~..^....n.......bF-;IN~__c........-.....z....E.e......c.....^...B.. ].......Q.:Zt$...........7...C.P8.&.....WD.E...<5..x.8.2.s.I.........I..1..V*.......|V.t.q.C.V../..._....O\.a...).'.n..o`j..lAO.aN{..t(.Z0;t...g..c4gF..#Cx.....yK...0.m..[j<.A.9%.t.Z..6..j.&...0S...(|.m.>l...d.......T.?`.l6.e>..<.....A..U......q&..!...w.'.fY..'....V}...d|..9{.?....m*.....;.0.]{...........L/4.T.%t..l..........u....*R.yD.t.[.z<....+?.7.S....zf..'!I........aN.P.\.7o.$..[.V..Q.j.-.^m.?%.../OH.P.7.S...Txa....?0..e....7_....C..].n.8X.*a<..Be2..K.f..R......3.X.J...7-l..+.L.....h..m....T..?+8.D._..(.....Dk.9."....E{.......]...R.5U`...l........FU..?...3..I[.Q..].....$.k%a..>.W..,(.K.P.1we{.+j.;.X.=..7G{;T.j.d5.G.......<9....AP..K.....r.......a...t.YP..;f~.(G..=.......f

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\109D080055C1548CE320A422FD98DA1D5E1A5BC8.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10206
                                                                                                                                                              Entropy (8bit):7.981617814622179
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:yE5+F1qhNLjpCfOicTK8+KXQnwr1PYOO7WKnhnd1rKp8rNvo6TrWQ1yQ+:bltVK8XRraWahd1Wmv0M+
                                                                                                                                                              MD5:6C210FC6B5EBFE546BA2FCFEAACB70CF
                                                                                                                                                              SHA1:6E1816D8C17F88DDC14394166BE7F391E1838898
                                                                                                                                                              SHA-256:256E350AD0A9E496F0E1F7DBE6D8762DC4CD44AB31F7A064BD27C60F51BBADAB
                                                                                                                                                              SHA-512:3A420C6B6A2752027E07D1B4368F6E32D578677C547C4929CAACC458338AE16781C3212703CCDC4B93A1C23FDDCB509B99545A7FD42C4C52722D9F3818F5BA8D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.l......i+....?..}....Hs.JJY..R.q.4...........x[..a..-6X....'N.....|.k....7...%3...y.}}*,..-&;$......9...."..E<.h...~.......m.0.........[..o9l..r$.W.saL'.Z.$.......&Z.".E.&W......:...../..l\!O?.nk..j.m.9[Ae.FiR..g.^..n.!..5.2.fz/.b;fQ........2.P.0cDH.....k.....i<.gHBg.g.+E.b..u..Lz.^......?.. ?*c=.-Yg.....F."e..9;1.7/.Vhw.Or.6Q.......Q..$.k&..n...kt..%...dO......E...&.W........8....q.T.....I O...6..x..>.....E...xW...8...R];......k9."]..{j.&...gh.M$..Gv3...U.5........W.W.4 .;..}.re]Fk.5x..M..Q......+.V..<..e.._.E.n..rq.P..&I...{S..Q....#..-cB...wo.1....i...L?V.._^....G2..g.i....t....<.......`...v..C&.u3A.0o..$...(|.9!..W/.....*[B.PEwc.....&*}...F..e.*{..D.@D...LHq.O...H~`P...>.-..V_...nw8.^7,..N.J.X..g}.[..w..p...../..y....*.'f..Z8F_&.............J..u..=S.r._.N.....m... T...S!.+...T...l..sd.......R...1qM.2p-........jP......>.n.|K....9..<el.x....L.............v.T....cF..**,.8......^...L2.L.;.c..v."...M...c/.)..?...C.[f8gf.g...g9./.;.......

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\180089313729568CF6D0CAF9991F0FA4115478F0.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):14510
                                                                                                                                                              Entropy (8bit):7.987194319289023
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:/A2K4gmygJ/fWDQJlq1fyGw3PUr6RqkWe9cqwuGmo4+://K4ga/+DYq1fyf8rayeVGmob
                                                                                                                                                              MD5:B68E5FA74F0D8DF5B0C0C86AF6D8B73C
                                                                                                                                                              SHA1:4128A4273FF85A512C82672064BEB7C7657DB58E
                                                                                                                                                              SHA-256:0D9B5F6567C98E3320B1270AB79136B5E5A11900CCE3E0C4B2FB9EB5FD632E52
                                                                                                                                                              SHA-512:FAF82EE7B5652AD39DB96579F72871BFC1E62730BA653B01A8206FC7D2829F0A00A73F5C965645B8F88A3C21E3E794867AF107409A3F28789A88A322599AD495
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.m.N.....6.b.-...3g..4....>.....6...@L<..R..S.5..!....u$....(D.lv..$.a...$....]5Z.@...X....Q.y......>..[.(8..bP......./..y.I..b..uc.Mv..2..L9.]C..{.]N.K>.9).*.<%N.o.,:.*....of.]66Y.?.T..~.ZL.2.).(......"......k.......4.w..]b..!i.&".......x..l......N.T.M...P.V.3{.G.o).%...X..{{.\...:5T.....x4....zV....'6=;.'...K@0.....{..aI]r\..`.o.E...5.....3.dN. .l2........;.......>..g..K9.!..7..'....V.J.|.g]Z..p.!.!.p..6lyl.......Kd}.HC.E...}.Y...3....H.U....X5"...).+..!...*......!+...9^V..j....e...N...-D,...-.j|...y_0.L.+..*.p+.2..*fS<..RIH..#...2h...l.^..e.Y.a0...1...m..6.Dxi....0..T~....,...J@o..3.y-..0.Q.nD.E'.........|......'Z..R ..@...o.......}.Z.{.H..ke...+..]m...k&.......z..V............&..*..........z.:."C.q$.=..f..$...VdH...vr.D.......... ..sn.......ED...x<...?.q.G...eg.S.5.{3....../......x..L+...wweC.&ro...p.c`........?....... a...9.0v4.&Q....F+9....fj..s..m.,...1_2..?<S...0..Y....f6 .vN..;....F.OC9\T4..S.B_'....r...B..g...w7h....55._

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\2275F9569F28969C8FC69F9660A75ADD1F8B963B.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):19987
                                                                                                                                                              Entropy (8bit):7.991806460759827
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:384:hz+2bt3zIqNPQaMfIwmlP6GWPo+axhh9M1lMDSP7jRwuWi+:ha2JM2IavllVhhcSDSjSd
                                                                                                                                                              MD5:D07357C483B2C9B1E152B0117DD19D4E
                                                                                                                                                              SHA1:A74373F1515E1B34A3C4302F344FD5DB35337298
                                                                                                                                                              SHA-256:693D44FA1B17850C73960E4E9796DEE19B3F3C3D7F20C6731EFA9FB151F1C238
                                                                                                                                                              SHA-512:0ABD4D7B5C2BD30D2B6323CD65DC9A94D933D47C36F76EE881CF9CBF046B0F3DFDBC42181FAB04213789BA08DD877802723E29762288DE0B88A855023F20EEC3
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:y8:...9...rO?&$..,....T...e.;.|.^...0...l..z_5....AIL'......u.............(....../[i...V.M.P..h:....../.s1SEa.n!#+.v...V...;.LjV..{b......&...........&....%l..5.s.f7Ys.jM.........#..~.vg.l.s...!.....JNK?Y......g....rIh&uC}..C=.E...&]..cF..GT....(.k..J...s....MAX:.....<A.0......GcA".l.@.}...... .......l}...*.`...LO.}h];3....IS.{..>...w...c...^3/...f.rm....w....Jf.U*..`..@.9....r.F..u..U<!.#....C..k...j..a,..]2G.z.UZ....rEcd...h....].C.!y..<.c.....qx<..3..c.d.3u..w...;.HXX1.]E.J.b.Sb.......k..s3L.._.=..R....^I...........Y.f........Q.2.=p.t.....2.%SF...........~^l....)3\.aT..~Z[+hp......gNHB.iM'.>B*..hJ?.d.W.....kx...5'.i...G..k...i&S.....S....t+.U....0^....7;....?e.#..[...s.g..n3.L....zjY....r.*q...g..Q.2m...E...}.5sg..E<R.P...t.n.......0.....Yrl.z.2...c..rz,&.v.G.W..+...H...R...m]...$......rk9...;........j3".Pt.....N..b..9Fjn[.h.i..'.!.e..P...^....z..`..:...Z......Jv......{9.....&q.qQ...._.D^].~HR..D.rD..K....%.0R.i`...N0..

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\22F59957B7E08CD6CCFED6AF2A1DF26FE157DF40.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):104902
                                                                                                                                                              Entropy (8bit):7.9983836366851815
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:1536:Fla8bpE5nEcbgAQjnB5fVAMbBV36XtVuYUHJRvpepgfBu0IsXaXJaOCr7tEuA:FlnbpEnbgAQjBheXtVL4B/26qMOm7tEz
                                                                                                                                                              MD5:9271776E0C0D5C1A3AA461997E7BCC6D
                                                                                                                                                              SHA1:F9195AFF95BEC52AD2F558E3F367A78D03A08FFF
                                                                                                                                                              SHA-256:4DCC031702A3B53ECAE3231EA93AE3E49DB85E39FB78D084C3E75FFA2D08815A
                                                                                                                                                              SHA-512:7DB3F6AF7540F6E4DC8A264D8C85A0AF2B50475074FA928894355B5DB41358F0D2A4D1B3330A6ACB4B99C75DA382EC1D712040AB8FBFE65DDBD5169815992452
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:M&m%......p!.f}6..?.M.1..........9&....S.uT..N....-9s,v...x.@..U.r..,.407..P......aZtG=..;C.2'.i..9&...q......s.....B..#...?...n.R.a...]"G5..L.T............*}.e.b!_ ..-.Z.}....p....5z..Z]....S._..TiB\.....~..S&.S...-z.k.m..pV...w*....4....p.[.s/...Z. ..cW.7H*.(.{../...i....."..8...v..l..*............D.3X.i.r.i^.I.....$O..l..~..:.0r...p.<.PyT.>.d>".).z....f.b.-..xp.y..`l.Lx...O..r...Z.s..~:.K.Au~........ ..e.x.2.MHu.e.$...r...9..U.].0w..'..\|OH..am(#t...D....?.E.9...y......T,...w.Ijo.x\..%w...E....Dx9..T%B.9 ....z(.......Gh..'...G.X.-.r..Z.......u...w...-..h......J+g..N.8w..!.................=n.I......w..q...(s`...EVh..Q4`be.w._?;.U...5o....K..#:a.8.#.Z[...3......a..~.....6..HH .HQ...m...;}...;.&F..e..>.r5.....8..8+..$"......W.e...%8.....~-]....B..+.*.....e..&u/..6_f.....[..]..H.a..H.4y5=.i..w...l......./n.d2.a...!...jX...p..s.W3pi.b....R.../.....4N.o.`-9..\R[....8.{...p......U..(.,.......~.[.........~......{...M.6.;#...

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\252CE8AC445A184A1F4A1C6C6D4ADB8AE41B7776.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):78006
                                                                                                                                                              Entropy (8bit):7.997595605483115
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:1536:qrdziNidxB/gIPy2DHIkMh3ESGl29E7vqBS4YoY8lNMwWUAM:qViNid3gIPy2DHInhzQ2q7v0Ap8TzWdM
                                                                                                                                                              MD5:9F100BED703A766B8547042637DD2F53
                                                                                                                                                              SHA1:4D370DED48C28EDFA2ED525B046E57E27923B288
                                                                                                                                                              SHA-256:73C6BFE0090039B794AB5D76D31D43F4B0647820F5D4B50A097F4DD495E21686
                                                                                                                                                              SHA-512:9559A662DF4BEE5C1C9019DD51C7AC730EFF06C2D0231E01B1DD0540D49FA8FE596635B61B3AF0B99B74334A11C5687E9664C8FFE4276AEBB60E67D3F4D910A9
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..7..<......P.....<..L..x.jS.......{..S....}]4.'N.fY."....0.4.~..Ewo.M.......o......@~.<.....u...h.9....]9Z.."...qu.{.L>...B......$A.b.r.H.p..@....p............R...l1.(..ATH;=&.%....,...Y)..{.~....._.|)..4.....".*W..!....[p..o..OS...#..].%);N.l...A.i.+.2Z.pT.i.....*Xo#.......8..~...{OS..U..&..`.T..B..{..L.q.....D.M.cO.:u6.w.+(.Ag.R.-i..P$?Pc.....vv.....eI.&.s...P7R.0=o.,..4T..!]!.x^.z..f....S7....(..t-..DJ.y....6?......./....s...".LSC...-%Fmr3.....RwYiz..3...Bk.<..m...e.I....@..;....c..p....c....}.c.sN...H......Rs-dO.>h....).+#..?w....?swwn.b...(..3.M..'.oS.m...7.z..'kl.+.u..`9+....];.wg.].n.[b....E...?~.;....A..!m...j....j.O...B.;.IL...Vm.."}....C+...j.5i.A.S..-..T...1...O.\...O.s....s..M. .D6..P.............K.0,....$%.{G._L.f.S%./e....'....om...\..L....u.ReXo,M.%.QKR..e...&.....K......0.....5..Q.X....8....r.|..i:BB.;#k\.|........^4.].....~..6...|4....lmu;P?.j3...;.p....m<\...[.=x..aG..........=...2....#ht.+.#a...

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\254256B27E0C48CF9B80B695F0B3B8CA84610495.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):9917
                                                                                                                                                              Entropy (8bit):7.982636343076344
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:XaTfG9awZHerykWM6CgND67qQ9Xj8/omXdZFYSLRaHFKjGf5WAp+:24a4BHxNu7qijaXdZKRHkCf5Wa+
                                                                                                                                                              MD5:66076814A79B5508A25F23EF839585A8
                                                                                                                                                              SHA1:695F21A28C739AF59B22D6BE917885677C0A7F0D
                                                                                                                                                              SHA-256:C455227BAD090EFA542822093C5B16EA206890FC6C134B8EF63964A098C96B37
                                                                                                                                                              SHA-512:D3F07F61E615FED9071B995CC499E2089E1647647C835F4D62E2A70F2C30CC79CAE7EA0AD58C366C899A6B33F1EA70091190CBEAE8E416B0866C83B71DBEDB3D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:../...a3..T9].^Q.Nc.!.{..b._Vk..+..'....|.I#%5[....]..M<@.X.B..o.."J.....h.c...6@8e.z..8....\..BYkv....'.'e...E...p.'..;.4 ..../.L.t...0VU...D..#..\..y@..Ez....{..~.B.h.j..x.2..N....t....d.......I...WU.9k...z..3..r|...C....}I2.h......4..Yg.u.a._....ik.~.W.......S.~.By..jQ...o..J..;..B.5...n..F._GK&J...AP+......=O...m."KKm$...O..#V .V.M.-...r.a....?.t...7N7.&s.4......i. .[..E.)XU.N.pH7h..a.!Q0.*x...{......A0.ro.~.......qN.2.R#n..ie8>..>q|....&............s.......X.......S~W.....6g(."..l...v..yT.) Y....E.J..[-.....1H..+..,.R".^.S.U.u.X...-4.i...1{.k.,I...c.O7q..."/d...u:ZRN....V..3. .k.G..<.K.j.9.,...k6D..K1..=.W]...7.(eQ.J...{.y..PX.tj....W..9.4..L.......;.....H.B7o<b..1.k.]..).Z......,.........v{Tsq.......J"..H.52.#.i.".....<Pq.9..Y..r..x....C..`l.........,WF...F..J...!.H,r.M.L.H?kLg.X....].......h...BK.......r.*.w....6.."..".&p4..<.........l.{m......o@D....p!.4.`.l..h.=B%.......>..0.Ec\$.hr/...1.3..s.....|c..$.,.+.p..j9..s.S=..Q

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\271A1C49BED899C458958AF0EF8DF3DE9353DBD2.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:OpenPGP Public Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10063
                                                                                                                                                              Entropy (8bit):7.981513099609577
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:WlXlhygAJnPGMtNwRD3Sk3Sh5Gvk2A0Vy4LFUMvlnYDtzkqzytrHaZSNYc+:WrhgtKH3gAIMdnYbzypHaYNYc+
                                                                                                                                                              MD5:5107D3C1CDAEC35E3C7856AB81445584
                                                                                                                                                              SHA1:F47C39897B49E6261725E513B96DF2F1E267BC06
                                                                                                                                                              SHA-256:E9FB60AC26D636772414B40322560B7EB6FF133BFB13CD6CA7EE9ADE6AA4E600
                                                                                                                                                              SHA-512:370E4B4447AED5EA078CB72B097871AAD6508E7B3A07B915DB20EFEEF8E05069B43E4CF46070F3C5EDEA175C2468867DAFA315085E4318BC4401558848C0572F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:. ....K..+7......JU.;k.,.q..\....s..v$./~n.O.pj....M..+.+...A.._.J.<...r|.g..8.)..g.j\..|..:...%....9....}\......2+..{Iz......".s<........Mr.*M!.:..,d7KR0.ZJp#.\._Ld.-..-..0...U.n.nF+.HXvO...W&+.W.N..~...$.....0.&Jc.S.Fv9.$Vp......6).{.cs...6....f........@.qB/k.#]..h.....[\...X.......#P..k.....cA})o._.../*C.ky.\,.....v.....e..M....M..9....3.k.:....r.[..0,...M.C.....!v...:2Mow.G.;S.k..>.m..E}Q0.k...u..Q..'.........h.(m.......&i.O._..s,.g-...U. Z>4T.D........@Bm......\]..oN)......w...g..x7J$.b..U...Ql...=;a.K-....c<..0E;..:iav..C.:.~..h|#.....5......b./1..H].b...T.F.q."V.C..P.`f@.w1..9....$l....|.l..r..=.#...g..,TL.&..../...QP.'Pe.c....n..O...'..n..5..U?w......]?r.a.yI`.....p....j...S..\..5.b.!:..+.b....SO.d...4.Q}........2jf.1H,...l-....0..).!...:..o.r.......b.a.+..#Oq.Kc...g}.y....|}....%Y.RF..Sd...Y.......o......Ab:... ..".i..n.R[Zp.1.z..[.8...D+6.DW........!.)...4..FHy....3[..3N..A,..M9...?[..cy....*.f......1.O.$./.H..=5..........I.

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\289DBE90018D682BDBFD59A3CAACE9EE538234FD.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):20866
                                                                                                                                                              Entropy (8bit):7.991841376317326
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:384:JxPrDQ/3OuFK3mq6nnDP0ywHVOhn+eWogFTpL0XTt614U1UAyp8+:JxjDQ/83mq6nnDP0Bm+5tQTt0z1o
                                                                                                                                                              MD5:2F348B43F4F54884F243A346DFF6945A
                                                                                                                                                              SHA1:BD4D75AF792F8A890E7C14D33188D4CC0C018657
                                                                                                                                                              SHA-256:079789A61980B822682800496510FC78FC77FF1D2928F8DCA9C52476D08F799A
                                                                                                                                                              SHA-512:8E8F7624C3DBFD760996DB14B33CB6EFC060F344C99220697C3AD8678A2F464398B38AD7C138CB26682F1841C4B30198441D56E69EB01705216544ADBA020098
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:R_I.W.'...Jx.t.....5....50b.......^.....(k..?.?.........'.a.H..4.........(Nw8.&.8H1.|.v.;..$...\._..wn+.q1C..n.>D....b".._]&I.wk0...... .B.;...?.1,...P?E......y5au0/.!G.A..}b.d..o6...e..LR.N%.i...:..Z.a?...m;kLT..%|.NaH@.QA.$..oC.Z.>`.............a=3>.3.tV.H[.i.pv.hwl.)9.........f...8r..6..w7.....k.11.KB....)^...V.k.$.68..e..5..w..G..%oB....f......(..p....x...i....u...`..mZ.+.7......k.D...D/=....A@.c.k..gQU.*\..!^..P...m...mk...."...N2J*FUr'.$..+6.;Q.>g.0\..|.x|.....w.R..K.t2.`...^.....m..@.I....L3.L./..I..VQ^..'..T\..j..M7%h.................6$.._.J......Kzj.D.Ip..|@v........S.U..5..,.....g'J`.`i....9..NPWv'..\...}..uh.l.C.....jMXV.x...`R...).ium..]zgcA.x..~'..d....A.z2^.@....a=...n.....T.....p+. IfH.%+\..W...Ql%....(.v...ua...]?...(Tj .[.....iVz#....B.;..#...`+..7.R.{.#N.l..C.?.bq..q...1S.J.7.G.T....3k+ WV.... ..x..q.-\._....F........gB..^..B.-h...*.A.......m.l.7ny.T..X..:.....O..k....<......A*slt..=..+.....9j.xR.A./.Ee._B9.?PU}p..7...

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\2915993ED9338054CAC5EABDFA6736457D96F724.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10072
                                                                                                                                                              Entropy (8bit):7.982360583310304
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:aLLTl7JX8tImTqbObgGL3xofQ049YpaWCE2AQ08sYXyVFaDHA+:STl7JOqXQxj0fapRiN+
                                                                                                                                                              MD5:5BBFF69415E079A8074B96132D6CCCE1
                                                                                                                                                              SHA1:696B37B7A6F068474535BCEE878A5CB4E9FBB63D
                                                                                                                                                              SHA-256:8F57186D372393ACF4ED12F372E85C06836DA4759F07525DB7B7BCBD48298517
                                                                                                                                                              SHA-512:40BF6CBCD537025DABE38BEE4A8192FB1EAE799FD82A19C01D56D4295B8E597677FCBBAC08A7E07F5DF598234FFD5DADA21502844B330B2B438893C488095D5B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:=.$b|...n......;...L.E....[...@U5:...DN.......wx....;.^..\......^.u....b..Y.1...5.N.l!..m.n,..d......e........P,....W..'.g...3>..%.....T5.....c.......Q.`...7.....0...5.8.i..m.XOd.ZH.x.L.%@>......X..`...y..(.<i....6^.`.2c..J..<.....\Y..r..x.ZH^.Y...^.z......xn...`z7Ej..,..<..pY|.k..a...IF..x0IP."..!S..R$..a.b;V....+.J...P.=.kRC...3.4.Z..j.!...\K"..............{......n.P[..." .'...h..san."...h......t.{...-;.[<v~j.n.$Z.c.H.`A.MI ..9..s.\...e..."..1q..V.9...8`O.j...7"....&..j.... $".4Y.......V...w2PJ0..D....L...&;. ...'..V..?*5mQ6e.F.I.:.+.....C32../&.i....q8dY.]_.9.t/..Q\.pV.R.8.KQ.....J...R1.L.5..z.M.R....S...0.$....(.V..7=....`.../.SN.q..f.U..:u...X...P.2B..on.....xo%.Rd..F.\.......(..m....%._..T.K....S.......d..~.......s.g....[....C.......{....J ...:Y.....,DP}...0.e...^m`.....x.`..+.i#0.,#GP..5...{...0N.B..:H..V.i..~[.c...sD[.S....^.r<...\V...Z.N}C..!.W_.V=.F.rW...X.o(....!Bj....c./J.....+.p=.FD.T...._n.....:...K..........&..O..k..8..}*d.

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\2AD645B73AACEECB546C581E5E777B2380198A3C.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):11802
                                                                                                                                                              Entropy (8bit):7.984489141302268
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:DFdIM+7xbHYvOElQPTP/+d5dj3t1VFfLaZMBBmGXtPwO7y+:ZdIH4WElQLP/qXd1cMBBmWP7y+
                                                                                                                                                              MD5:B136C6FA74DF9F8BC0F701752AE18560
                                                                                                                                                              SHA1:A8BFE27A3469C8ACB5EF6EE98DEC9D132777FC82
                                                                                                                                                              SHA-256:A163B679FF492E9C6F987E873421D1AB7DB394E43857BBB1006D1F5EEA75A05E
                                                                                                                                                              SHA-512:AEB6B34646BFF5094551BC275F1ECA482AC5E2B419284DCE8693F835D061C309B81B1C0DF089CADCC3ED225AB0E90BE29255A1A14824D9F404192E4A00F5F3CE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..oO.t.D......kiY..F`..g/...q.vdT.-i.%...p...&%.&).....n...G<7.H?'(....h.d...6n.&...:...RK6.......=5$.GI.o..Y.v......r.^....wm.s6iH|.b.<.ov]"...j.9i.](...~........{,..b&H...H.0x.j.....t#A.a...+.^.....k...Q..8.}.v...B.......E.(M.......ti...E$a.P@0...;...n....7.8...?.....A....E.{....9...S.....E...mIF.#...RV':%p2...<.[.}......+..J.q..._.{...w.}.9|....h4A...b<....g.K..-;B,.sYz~T..&.......c...M.!.._.........FSm..4.t.g..q.-..S.T...RS.s....<.[..e.(O'+.~../......J.....3:.o..u.O.....1]....n.>1`..A..IU.B....O..i..G&<<..X..I.@....].:ihcr.k..\.../=0....".N....W.... .#rn.'.9.B.....u..3.[=z.`.....@.h.J?.!.b..3~.\T._wh."c...s...n......l.j4....`..b..+.Cd..n.;u{.N..E.).....Vr......(..>a..x(..y...niC.....a..4.-.'>Txk...I.....hv...5.....ZKJ^h.1p.......]8.b...1..w3>....%Jz....T...C&..m.Q...........J....j........|*"..(G.?<..e....<..aD._...q.{.....r...|L!..Q...f...g....At.....r.`.#e.....!B...g...f..5{1.YU..F..........[N.Y.sp@..1*.@....4XF.....S..+.5.0

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\2B8DB5289EFF0A466C21F47412A322A36CEB5044.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):105774
                                                                                                                                                              Entropy (8bit):7.998401729826873
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:cPH7FeWMawgUiglNtWzH4D9I54EvKsdrrh9U:cf7FMawXdl3UH4pEHvKsJg
                                                                                                                                                              MD5:8E5B910FBDA49841762B6DCBB7EEA5F0
                                                                                                                                                              SHA1:1F4F0B31EE6E4E28D5AD83144ABEADAC641FF412
                                                                                                                                                              SHA-256:78BFD8CBA244B6D62A1EF40AB93067E566A0B6D47F595990095E340535B92807
                                                                                                                                                              SHA-512:B18738D0AC4A3DBC775365C524A034925A26360D261DF1761D34276B146BB8AC0831A0DB987A36353E9B597003577B9A84E2BC33DC7309894241FA58A03F2974
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:^......z.~..o....#....2.....0../x..^....n..t....)O/......ov[..k9>...:..5......B.%.)Na.. . ....G.9N>.\{*S.:.l...B.B\....m[.|..D.J_...4... F..a...9.@.1..:..U}....GV.SW..E.a.4'.M....Rh?.L.s..~.a.u..(.').B..a..&....uq.>`u*:..*.....&G.M^b...g..C.:..#_8u.`.[.]y...t.+...c...v&.......0v.J.+.aF.....".2|..~...r.. KQ.R<rM,N.8#.Z..._.....x....\2Y"....\..qr...jL.w.Y.H.q......s.+...L...<Q}........%`M...v.@I.sBKp"}/L".1..I3:;...F....#......f.\.3W.U....A.6.Ni..@]...?C../.B.].(M....ZX........:......g6.>.d....s7\&[.D.~.n.....Q........I..^...y0D..)Z...<.r.LP@X.....* JY\.........Hto......!^=.~U..J....).a..".x{W.Q..$..{.|..C]....q...O..H.@I...fim......tG5..%.|..rZ.Gt........=].......fr..w.@..;.%q(f3.%....G......y^zwND....S...)=..\...Znt.O5.T.]...y.6Z`I.t.4.c..".F.Q......%K.5...VZj.H.Oq...=...u...t>..0J...K.`G..............m..P..B..N.6....._....P....".`..*O.p.7.5.S..S.o>R...i..KoXO...[.au..........~.f:.]..>.pH....4#T-.....?.3.....l.......).......p[N?..8[]@.#

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\38FF788A718C79DDC3D1E23EAA975517D9BA3BB0.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10214
                                                                                                                                                              Entropy (8bit):7.98260431389322
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:ZQifuHfhHWCUr+c2dYyPUJ5W2u4wuRFYJel7sPBPsLS/cp+fZ+:CifUpHWv+1akUJEDuRFYQ7OJ/cpG+
                                                                                                                                                              MD5:710F175A295CBD7E87D3BE0014946156
                                                                                                                                                              SHA1:A81BBC00DF84B84D3E2C15575AA40F42C1A8CA0B
                                                                                                                                                              SHA-256:1EA900A1C0EF88A53F194E71961D88DA1260B7FE6B9A2682003CAFC656973264
                                                                                                                                                              SHA-512:D8229F5191E3D7C7B6B38A4090BEDF088AB2A7EEFC40159AC1D45DDA9BD91D8A00B714D18C22365D6D7B1C924EDA040D7C37B7263C4FB97DCEE0F19B6244569C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.'..{A...Qi^@1.6~)......dc..T[.b..f.9`.,.K..s.....V.i..Q.....M..v.c.3...<@..aB................C..2/{.....o .........(l..jhh......2........=...9.W..Y...Q..O.h....W.w.N<.....i......n1.Y...D..\..c.a..Q!RaW..._. .#.NX....$:.N%A.U!_T......5}/.?.......u.......~..x....u\..).};X.-Jo.C.1;O..!.^.o.n.G....].?.7...QT......f ^7.:.?...j.....Bp.......f\......*....W.Jf.L....m#..f7.%qP.d.....m7..C..t...m<j9.pq.3.s_.f.......(..@$/8...U.z.y.1J...-Pl>.....$..n.K.O1?.V....G..?..GC</..O.9|.s@3/.......<\......,m..O5...7..M...8..V:.=.r..6"...u8<..L.v.`ZX. 3.?..r:...y.L.w...xp...KN`T...).z6..3,.E..T/c.:.......7}_;zm.x......5....F.....<.pJF.:..5KO.<E..e....*....;...h..>....t7M.:.+....OG.!s7m.Ic....0.$...0.h..._.^.#...4._........~.....x&....#l. .r..q...A,1.......'..mpa-,.ij..mRMp;......D.5K...Z.>..f.K.c1.Ww..gm.."_17W.fYg'.e...4...~V[...@?C.S..w ..k......Y.;41.Xi..d1....?..!.......X.i... .[....D+...A...A.<....\...sz.n#C..\).y.|....`x....^Q6m.2...dU......H...|.j..:...(..

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\3C9B2D192D535C347CDA9FB12BFC88FD40CF0382.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):97795
                                                                                                                                                              Entropy (8bit):7.998174447818279
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:1536:KHwzOyG6zCEhNerDpqozdk0AnRxf3C8Qkt7dUW7j9B+KY1T7C/05Wa68NcACHg:ewzTnhNcVlK0ARxf3c6dUW3EO0vTNOA
                                                                                                                                                              MD5:00724195278E45980F57EDB634B74BF7
                                                                                                                                                              SHA1:3A302C7A38812263689735D80C21E070B178B0A5
                                                                                                                                                              SHA-256:3214839B1284A1A0AB6AAE2FFAED99AB781FB9869090A96A1E9A7050E4F55318
                                                                                                                                                              SHA-512:7CC2E0A5D5A48A24D05BDD1E1AC9031A1F3E095062BB836AB147AC46ABEF3527A379208C16C0AECA9C968394C84EF17433D34969FCAD07A44CF25A49E55A182B
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:E..m[~..l$...S. ..\.....>.{1P.h.gJ8W.0.g9:.b7..Z. .i.i...[?...`W..A.i....Ze...E8.b_-.|...M.H..l...u......n?1..?.ffR....<A.u.....eFI.....G..4.....X.&.%..8.)U...M.$n)...}...1.;o2...,bj.2.....~....!.....n...E..Ks.......A.....V ..0JB1..\..m.8..t.jJ.A`..E.i..*MC..a..z@%j>..IC...FM..+2.-qm2...-.\....(....@w?&........>..Nb.j......Fzd.F..bX.V.....lP..[..Q...N.8.E..SZ..':..H./..%L,.u.......e.[#E<.P.........a.M...b.;:..X.X..y.+..{.'.7XP_........i.E...M..z......).9......"..3.{L..8..G.j%].>...Xf$4._..KL.y>.hId..1!~..C.......p...U..5.|.ea..)......>.....J.#^.`.s..i..].....mq...;(.f.|~...}..].As!M.m....T...L{...H.d...?0...^D...*.82h~...S*.7Z). .=.>.-s6.|m+m!.`..t~sD......m .I0..k.(..)...9.....h.g...x.|..c.7...H...L..x`.......\+.2Gab&..H]..W.....9..-...O.2...s..jN.".....4.....j0.J{[(.;.f.../....5...F]m..,.../J....s.?...{V.O..>.....x......".eO }5.O...BH....l..DV..1. ..W...dm..f....0Q=..:.3]..L..O...}..|.2O....P..6.\w.Q.......t....8.|.;..l..g.

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\3F5BD2A3838305545BAF11838A20DDE8D3F6CABE.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:DOS executable (COM, 0x8C-variant)
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):9612
                                                                                                                                                              Entropy (8bit):7.979884102660943
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:+fF08w1zS3jvNIlsAw9rNPcFD/JjQkkkLBJLR0EM7ShGtPj7S/yHE47N+:58wFm7Sls7rxctJjrL3LOE4fL7mW+
                                                                                                                                                              MD5:4D4FA5F340F4BEFAFA3E1E4E5A2A9F64
                                                                                                                                                              SHA1:487715DF6E5B5D5C0255AC88C104955926945DCE
                                                                                                                                                              SHA-256:FD6DAE4E00851D899532C8599DBC7DAD150315D73554ED230A074774F02BE543
                                                                                                                                                              SHA-512:4AAE44BAAAABFBBC1688A6ADB6C0FD5CE1CBD92F5D1292A088849B39C33B73B0B6AA684C84BFE56A146FAE98911857BD562ECA801AD80A256775900184AF580F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.{...x.3t..B."..xA...........]....q.c$.8..+.}.......@.......r.....x....\...$X72o..F|......t..F..P...$:.2....F....%.p..........s-Dz}..[.........1...(.....w.n..p.....J.r(....m.J..!.C..... v..|.X.+....Z(...7 '..J.I.c.O.G=/.oU...oX... ..5.....0sp...)....>..(8......l...-...t..........,....KZ.....R..#....j..@"9x...c6.z_K.<..(.s2....>..(Y...*....%%q.|.gcQP..?...L...........@....^.f>.`ID..n....#..~Bh.A.m...-...9.(....})}...If...z$!.Z..w@...S..8..>...}.y..".. .^P.k.S..V#%..........3.:.u..mX..vr'*.k{kWf.g.>.fV..;.C-.AW......Sr.}..h....TAZ['..........@.c.(y.B..M...U`\/...15...jO@.U+.R..I.%..K..._...v..2.q.?........{7.d..2. j...../.c0..s~..B.tt.l...,.XKs....r...B_.....+.l...Ho...3..}..-...@).^I..8.T.-&....2......A_A...t... .$..2.....6.............hQ*y@&.G............8......o.......F..K..,........._i.O....._...JJ...S..........Z.{..}....4....U...v..rcC...C.]R.].3...}.....dD. .$u.+....vL.....}!e.88..(~...1.}'....D}.,.....<yG......#F.Y=...

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\44230749A38B6989F56217B435A03E84CCADE62D.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:OpenPGP Public Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):28323
                                                                                                                                                              Entropy (8bit):7.993152412688917
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:/aN1StydZDwnGf//T6rndw/YRVhXjh97g5+P:/aXSkdZDwUurn2/YrhXjr7g5+P
                                                                                                                                                              MD5:F89470476FD1CFA8213C0EEE92D3C3DE
                                                                                                                                                              SHA1:88E148983825758A940CB17060DD6930416676B4
                                                                                                                                                              SHA-256:DE44798247033A2CB72AEC9E5BB647C6B82BC32432C6CB22C4623B27F3236C14
                                                                                                                                                              SHA-512:252D7FD9B32AC9B90447B798C1BBB519A20B50CB644978A873FFCC61BE47DCC826A490DCB171FC9B2937C3C3F8136ED30E9485378C804088CAC05109EA7B7F93
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.(.*.Wa....lu.nT{...b...S.b...^Bo.x.D F..'.v./.|................*f.Eu..A.....].|.o.....%.. ...Fpn...r..'..v5....!cD.~....,8.}5.\t.).....Q.F...U......F.....>.W"`..f..%..z>2c.4.]G....2t..z.{../.Z.3..D..CfY.......X.......*...%.~......L_.(....v.......z..#.o....P<5..^>....w.dY.. =....a..*wOR...gU.....*....Z...8.i...P,...J...k..eh..l..o..(.......I.....a.\.p..FTY.R....8.m.?.2..byH......Z.y.R....9..=.......G..C.my..../4.A....D.y......zP.D.~.1J...3.i8..k..~g.Xzg.s.9[...IQ.......v.G.....P.tJ........fW..@..qc...r.5...ce...;.@.g={./O.s..3$..Z.s.....*.....(..$UE.ha...].Z;....E~.....7...+.O..Y>.....e.S...3.......`.w;.@.yfO.@R../..t:.......^.&Pl...o..iZ9U.s_#.....i..0]......Y~...'.._..(/)....a.e.v67..._.......C...'.8..%~d..NW..j6k3.....m.Q^....F..<d!..... ..3...w.?.M..\...4...x.d...~.N .>/.......0]..=.h..o.3.{.H._)..N.j.........)N.........u...........5.............f,.....W3...Y.G...-..!.I...A..{.z...^........|..N..D..\.3..hk...sfp......#p........F.

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\44F3556BE808F99573969118A8E36879BA1ADA6C.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:OpenPGP Public Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12489
                                                                                                                                                              Entropy (8bit):7.983955967073054
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:dHTXH7bXF75eLYkuKDDL0wkjbPZ4ZQOJdqRwuYUiUp8gqRWQi+eVXYVXOzBxC+:VX3drY0wkjjZ4PQFJiU2gqoQuXkXODC+
                                                                                                                                                              MD5:01AACF0A275960D081AC1CB70E8AFA67
                                                                                                                                                              SHA1:07C36A51B01058178FDEAD5AD2CA8A3AA3806DA3
                                                                                                                                                              SHA-256:EFEA0D181E1FF1F9BB8583A6222212F092B8F62F648CCDC45F08F9609A02BA04
                                                                                                                                                              SHA-512:FA340886FC5DDC1993A5D1862E0E59BFA6D188EEDE9CD41DEA1AAFA45FD69337074B1B3FE5FDFAAC667FAAE0658BFFD837A4AF218BB701EF94507CF0AA184C87
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:...o.o!.,.b..]N.B...N.....D,k^.m.......8J..*>...U.;..?J...{.^[..".h. ..~.G!V...g.6Y...e..2.....M..X...VI@A......3...@..@C.i[.....^L.9....@S(..X4...)...:..cz.o...N.X.;..v@...k,..CZ.u.I......t.@.O. ..r.a}K......w,.l..m.X.....qe.C*..z....u.$....tm..9=..pmK....]G6..U......A.CW.Y|...D.(V..+g...3j.c%....M.W. .I..g.&.r$....7'G..t....m|.....N.....yN.U|"..'|8.].E..f.'C(l.<k...x..X;..._.De-:...4A...Fg..c2O\e.OT.@b.}......+....-x]..4.Q...a...jn[....G...q$-L..?./=......m B..l.m..P.i...QeIb..E......7aW.j..Y..\).+...Ve........=i..D...(m<W.U...j.~UT..mFO{7X.......z.<.bk.,...\.....`.v...2D$^)."n.(m.{...{+N....:v@6.+... .E....a..A3...-].....R.aD..'......yH.l.}.._Mo5.@.....m.T.v...{zEcm.|.8..-.P..p...od...E.E...NO.....i.k..]...g...<.........nK...iBm.|!f(2..MT.).R..]Q...P`..............L4...&l..U.t.2....Zt......pAah....:.c.k}y..\..l.Q.6}H.....e...K.....Q.?j.r....&Vapx.$..Hc.8...@y......0.#.....3.,.w8.Z.t4...]O.hx.....>....!QGaq.TN..D..r........P..r...

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\4BEEB42810BE832BBA91594E58C616495F4E9510.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10068
                                                                                                                                                              Entropy (8bit):7.982035838661474
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:5dZGeXV8IwJPKgGxGda/BPOjucAP7UJqDL9gOw74U/QrYM+:RGeXaTUJZcO7UED+OMKh+
                                                                                                                                                              MD5:A93240BBA35198D24B2FF9576AB4C8BA
                                                                                                                                                              SHA1:72725C2D223B601FF28FDD9CCA59297541D723B4
                                                                                                                                                              SHA-256:6704CE4028D99068DCCD7C1D96151B5EAE859E12C185B5B2BDE5058A1C205B9C
                                                                                                                                                              SHA-512:EC5A4BB4677CD7B51375629C3436589612EF608B4B8E78AAB8C181E99F8F5A4AFF9D4C912B48DC4F260E5908399A43D99E5C4A496E52717279CD9D40AF4C15AC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:d.q..8....<9.k...."..B..kp..u......W....."c..q......W?....d.[@E.W.O..../gO.+.4``..}.Ke....S.._..:............3.5..3[.....!.e1.......N...^d.i".dw...d..c\.JN(-.[..i?..:q..eyI.4..VE......(...+.}..[[`fm.x.D......w#.GJ.H.Y:!h...........Ku@...M......KA.`E....y....%...x..".k( n...nQ.8.0.?.o..)*..........].yk.`..X@.=.U..."...o......(...GD.9g..1[.G8..R.c...(...}..3N..9...*.".'......Y$.`d>.|....hS..v:..H.K...'g.bv...U.#.......W.1.[d.6.Z_.t]...xZD.)....K.....&...Xm;?......g.<..@.`{3.x.x._ sT.P@...j`.}v.l....?....1.8.......n....au0.X....+.... .....#N.!?pc..7\..P.3...[~>I.....H.H...'.O...i.(...Y.i;.=....Y...,....q..:.*...|.h.......x......C.Z......Z..g..<..m.ad."..E1....?(.2.W.t.@.U...o.y..+.|;.y....-.........nM..........n...*SW.....2u..a..I....-A.....=....4-....bf..h..?..m.....-nCU=+L....~...3.U..L...."h....t1?.V8..pe}I`.j.....L...............v..K..E...<.v..tG....].'P.L..t<p.2.*(.o...e......'GM.1-b..,.m..*.=&. .Y..D.D..s.U.*..E.@.).......+/k.....

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\556841CC95159B63845C2D77B32754EDDA4929D5.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10070
                                                                                                                                                              Entropy (8bit):7.981474168894085
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:8ZUu+umP3zWyux4YsEjICHTF0Ehu79Jtc+kGeSXQe70m4QcdajPb8hvD9NwQvP6+:8ZUrPiyux47EjzF0Uu7Vc4eSA40m4Qc7
                                                                                                                                                              MD5:CD34D1B206A8BF718EFA794165D9C352
                                                                                                                                                              SHA1:69B874AA6D31ED4617CC236D7CD42D58F9685B14
                                                                                                                                                              SHA-256:61B2F7AC36D282E65670FF856D71466467B454922CF6933B5F004CA28A944344
                                                                                                                                                              SHA-512:C2930A3856F9326166D0F502CEB974AE5682FED9479D3A053230085A7BF9501BA04CFD1932050E1D12B9AB8C9D4B280EBD62D3C0162DEB8725AE349091328845
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.O.x...&..].M..".....+`..u...M..F.8*......F....5.F.y.`mZ..o..7.`G.P.U|).h.!~....9.....&..?.B......i...2.@....+R.WJ.2.../AC.5.....~V?._.2......o..}6.q.$.@L.H.+i].k.[.X..N.z#.D.o]....k.D.z6..22.*..;........!.+...7....l@...7P..3F#.4.F....*._.b\.o.A..Z...X..R.Y%{..+..*T.4...%t.._.....!...3..e .7K..#)}{......i....R1.I.a...Cb...w.X.d.{T....V.|(ef.V........\WP.. ...j.4.hGe(..tM.H....l.y....*....|..]`=.P7O.K-..w?.E...P.{F1..,.....p&2.!....jf..3VG2......b....Ie"w..N.O....<...._...2.......%...g`..>\z..I..7:4...L..1......p*..$.?$4.PX...I.....!.O.e*"Q5.5.........b.p0-s.x..V/}..#FM..'.H.W+..k;C...&...J.....].......N.NC..:.0.u./V.C.......H1...]L...M:......V....[.wg...3l.-kO#.....tk..}..0G.u....Y....wl]U4C.7..t...B...?k..@..<...^..Io.F...S6L.....].n.oO...t_:..M..../.|.........)...{c...I...0.f.dj.....M.V7... Xj.........V*.9.|&<Uv.W.z.'.'.=.....' 9...||..1.8.......).-.......c."i..$bP.X.J........c.....}.<.L.../.z.c..1n.}..:..r{.....o.&.@VX'd.. n

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\58A756A796A86993036E1F0F79183245EE2ABF58.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):14527
                                                                                                                                                              Entropy (8bit):7.987348091752629
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:E4LNz9NXd0eOiv4+g2d+hnPPsm10k3eXg+:pp9NXd0bQ4K+VPN3eXz
                                                                                                                                                              MD5:958445B3E0C91FF90CCD66EC6621B478
                                                                                                                                                              SHA1:783D9C322C06B4DEC201F093EBC08434329F9A71
                                                                                                                                                              SHA-256:07EA134DB255A5E48A95EAEE57DE1FFBBC38C383FBDDF7F687087EA293B8A839
                                                                                                                                                              SHA-512:0BF53F7FB0E8B7158DF29E883451462120A9FC3239C0A87909C445F344F1F1B0762762B60B2D1B3C7E194BD16B2D8072516A6D0551FB616541B7C1415E48F0F9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:DB2...9..n._Y...Y..........z7.M...6.m..YA.....3#.Y.N2Y!....c.?..-.E....<.....!.._2#..2...I....Jw.....8...R.L\n".b.'IcOx...j...h.".J!^.......#.x+.r.T..|.a..&.....F.F.^...DUJA.\...E.TK....\L...<Z.N....9..>..y.;...g...1d..`.,*.E...b-A4.....?6.N.....cUl...o....d.*We.T....:<$....f...........<T..@.........H.q=.p.....x..:.G...Q:...s..pqw.....#..X.:HHh*cL.v.Y.X. v.....u.....~..h.`...@.G.......v.(.D.=s..w..n.O`d.u..VU.#R...z...$z"2..e.b..];c....>.z`*h..8...i^....#..8.N?..c.,.....0......T..I..g..u.1....v..o8...b.C.T1....n?....T....._..G.^.|&.7+u.....O. u....O..)...T+../...8.~).....6P.............4..L.x..ohUl......[0.w:...)[N#M.....(.m.L5....l.....y4).1.,(...."....6=RnM>A62.@.....*.k.q......{.M..m...R.S5.."....T.<B...j.U.}~'K..........tj.j.?.@...f........V.W-N.D.~.4......`.V._.S..F{..i1 UYpO..5..j*.e.......%.....v.;(`.[.gR.8..........=..$..Y..n.:.{J...K3.ym`......X....#..\...5%......)%.+.V......+...%..X(jf....`..Y..5...KG..E....H8.h...lB.

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\58FA4C93D2C2293EB9F0554BA83740A06674316F.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10395
                                                                                                                                                              Entropy (8bit):7.981376050898877
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:O92i/tzAzowgjPDy9g9KjI5XCRGlIj3sjkEL0F4Wb1YChQuR3Kl4Sey+NWKO+:Ows5qKK9gcRGSj3sFoF4GYwNyUWKO+
                                                                                                                                                              MD5:FEBD7ABA7011501383077D8DD57D208B
                                                                                                                                                              SHA1:42F0439DDFA13789DC9DAAA350D98926F9C8FDF9
                                                                                                                                                              SHA-256:8D5C5A5F0C66EB174E05F9CB1D156A175107A521D5A36F9A7511AF7B1AC48BFF
                                                                                                                                                              SHA-512:CC1E923E46F3FA6937186C6B125AEDABF47CB69BDAAB8A21A2B53BABA999C9B1FB04BA7FEDC4543B0A4ECEB3E494372DB74A30F848E96A2F527ACD54D89066D6
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:uw.s.T.g.FGC.`\.t...y0...B...)...>.`.0.Kd.bf5..49.=...a......O.....#..2..W.,JU.Ov.8....."u.`.x...`%.Z......_..%....3..k.A.T _>.....D.E..,....+...<.).....)LH..\...L7....D!..=.D.4.5:j.z...#.`.Zd<..J.._.bQ.....e.QcB.7.a....[>.v.z. ..e.....0.{N.id.V...+..n.....]..r1.@...dI.3.@.5..].K...dGG..V...:]....q~.W0/0Y^E.L.8l1h.&.#gQ2.z...n..!t|.pJ.....Z..$.EWv..!K:.{..v...J.]..6....B.p.].X.[...n,..HKR0|...h;$......Ls<k.JMP.W..n.L+.(.g....q...t..V.g.+....@3...N,.I..e_I-...h...<-..Q...C.rL9C....?)m.=7...Jr.8..^.i...5....&...8.\...L8r942.>Q.Ky..#..d...r~.t.4....=..tz:|l.(.....[..8.w...S>.@)D...."%.......`..2.;...P...}.#..n.RP.....7...d....W*..W..b.P......AJ&q<2.s!,x.6.L.......m.^..".....C=....?.qr..&=".Pn...'z.c[....vE,.@c.i.Y..W.58...A.?.A+....g'.3+5.w..gN.I....(w4..HUK\...d*!..S.....'q.iC..Ed..].f...z.j1...ij...h.......l...."..,...H.,'..'3b..?....A..m.>.k.;<..lg..\_..LT../....2..4...R..uW...8.?<.)......[..X..0.#....ASkYl....D...'_.....L..R&.l..K..[....P

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\618AA02AA865814C279225AD803155E0A84FF649.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10070
                                                                                                                                                              Entropy (8bit):7.981669087480124
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:AJ+0co2imd8Enk8xpWfD6T3aIpZYuOXv2lzxP+LXpu9hIsORwuCOkB+x+:g+0coekyWfD4pHYVX8JSpshIsXKDx+
                                                                                                                                                              MD5:A54E9156BAE8871E1D997CCB8090CD44
                                                                                                                                                              SHA1:83DECDA0EFCC19376C414FF4C7C41FEF0DF06D42
                                                                                                                                                              SHA-256:C1AEE19A7D64AF0E20D6A7D428E526D700823415A3B8C34134624CDE24A0637E
                                                                                                                                                              SHA-512:D57F250A14F8B557375B9398EF1F153CE0B961C5D64286D1761E1617705907AD9C6811A1EED9E95751B4E5854BCA4786E3421C573ADAD7FCB47F43DD8D34A33B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....W.q..j{.`...\..t...D^AlX.x.f...w...?....|q........-.'=9.8.N.}...G...p................=z.....j}..5.....S=.#."......>k.G.@....P.....{......4.=.L.....n.k.u.W.....?.<....b.$....!:.J..9.I.Uz..k.^.e.4O._.U...C.1..V..#..B%...&f.`@,.N8&..~.W...W..J.X.J.S.4`....q.$f'...M.R.a....y../V!.<......F..N....Cy...6\E.yg'C.>r./.q...}...,.u..P.N..I.r.=2.[4.?aZ..E....X`.{.J.I..c.4...X....].;(..3.'...E......e.9.(..z.c..o..-wu....^t.B.-\3.....Y.5#....c.u.....OS_..m.%V.....i'..O....\.....K............d..w....-8i?..'g.h..T......h...$H....AQ..........!.1..p...t,...c.to...S..I.<9...]...a#..h....WVbU....]..u........... ..@3..+...g....c...@1..+..b.W..!."X3..K.~j+l..w.....,.Z.v.p./..v..wT...vVF..%..c..S....*...*}{/-6U....L.B......X.Z1..)C:.....2....Crk6.....~m......Gc...~`x..2..0.M.JS.6?.....b+.+..3.m..e.K...,.g...9.l.i@..ZC..@.....NG...f|n..7G8.Z;+...PR..<O.=..`..........i.M...9..=2m.s.Q.c\........z.@....J?..Ge.z.w..[..&O...f..!... ..D...l..9.......l.A6.f T.a#..6.y

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\62FC1E8DCE1991EEB55DE9EFADF47EA578A22AB5.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):27876
                                                                                                                                                              Entropy (8bit):7.992892998853212
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:dAvgzMa1aGZipMdiRjzY4lNiyPeukxOXY1R:SUvZYMdiRXY4lUyP8yYX
                                                                                                                                                              MD5:01414B602088AF99424349354366B47E
                                                                                                                                                              SHA1:2E7DDFACD18840BCF29B2720FBC68B27A3F6934D
                                                                                                                                                              SHA-256:89E56C713C28B7B4BAED6B3A865908BC823A2002E1511F731BE6051C0043142A
                                                                                                                                                              SHA-512:49A0B0BA8C99706F0EB34701159C92B64CF9D0C340E313DC2C2EBE7FE799F10E3B20BBC7536FDCB51066A4FF81FE780C471A6811CEF587DA55B97BE61884495B
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:%#..Al.r..j.....P....H5..J.......E..W......P.t...[..:..L.....,!..|...f..P.u.Rm.....ju.r_<..S.U.[....;01a....WU.......W...Bt..C.|.V..}a.|........X.V.\...s.VQq4...E..i..+e5..U...h:.z...]<.2..;S5Z..[.}.\..,.'.`.m.!.D..........p..pZ&{.R......5.M91b.K..-..so.LHN...M..;............1b..V..c..:]Y.5......Fs>O..sx..1..-.Cu.I.,.GT..>..{`D...{:....=.,..gN...k.."..m?L.E._{__m.Qz...a..)".H...#.K....QAm..z7..Ml.j1...e.AJ!S .,..g....!@.....#.va.{.k`....i.>._<|It........d^w.A.0..X..&+.D.J...O..(....y.Z....n.,oUju..2..E....w..PS...E.XQ.r.....X..G.R.R.BB.....oO...Yt....nC.Q..<K~...]P.....0....s..|...x5{.5..y.#c..X..;.b"Na.8.....EPO......x;.6..4....{..U ....B-`l...3.O..h.3/.]Fm..q.Q..m...Qu..zvMy..`[.4>.Z..;x."..........9....GK:....%.... .......,.....o...]..I. .X.Z.j....T..m...w..;!.B=...A.'...?..!..K.d...0L..B.y..l.C...=..f.O1..J.Fu.|..i@....+.(.Y.,.t(.Y>..V....Ci...q...H.....Y,.._....+(.h..X4G.YV...9....>I.6...t..L.~........[b.D..O[.2...=_6u<..

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\6471FE741131F408228B6C4776946BF7FF3BC4F5.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10060
                                                                                                                                                              Entropy (8bit):7.9809439791923875
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:Ft1bCqhLW0NUDEFxhdaWbERfh8RO1Iowig1FuoXINQuRPdo2AX7850sLTfvPy+:FirY988ROYiWYYC5AQ50sLTvy+
                                                                                                                                                              MD5:9125B490830621C1B06F0E7B2C254C3B
                                                                                                                                                              SHA1:29FA820188D6DE1A5F39B992FB3D9EE040F71B6C
                                                                                                                                                              SHA-256:1212D831FCEE7BCE7FC02527899725EE8BA34B793C5626DF746FD218852E3A0C
                                                                                                                                                              SHA-512:AEE2681E02E7C1D03CC279DB1EAD97765A1414172A1AF5AF33DD13224A27E91EF531437F21E49B5606DF4D08D48DD72BBEDDD5467C31014792015B15D12D24F8
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.`.2pQ......*C_...9.......s..;..E.....+.t..)/.......-.}c..&...l[.....Ps&.....@.....{.X..<.JV!1\.B.....T.R.Y.e..F:x..+..Yi.3>F...3@.Z...X.5..(.S.`u.4....*....I.=`..E..N...&.-.5....b...Z....F..)'.$E...X...M...*......)#.t.y-..T..5....bQDJ.U...e>..Z..1...7...V....D.....?#.j..`..Av7A........)*../....Q...|.}...........d3!..N.......+.N.rm..u.l2..h...8..]nAdd...]..`.a.4.`...Ot9..3...W6Q...P*5.....&.=$v....!.....ch".HY>.......9.Hn....K.)..+......=M...bv(#q.n..v.`.Cn.\3..../.Y..LikC..AY..}dW.Mu......d..e...).........\Tc.6..=._.J....J...W..tgO.d:......."o.....s6|.I.Q0..&"...(....T...#...X;.@....g(+O.j...qj..>g.....o....$5."z.T.......d.......x..sm..k..%.9S..E.|.b.'.Z...;ef.,I.6....5o.$.4cc..$.a4_.. ..l...E..+c...!wh.Q....Wt$T..1...n.....`...}.Mx.S.[...f%..kT..[.#.0.-..".#..8*>z./.F+..".%..p..iZf..(<.v......p.....!.;...d.)B....=F.-7d..8.?...xQ<...Vl. .[./....M...{-M.M..Z.....4...|.h.\d|."...).M.-.....y..&?.s\~...uENk.../...<8t..N..Y.$nh

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\65EE852228DC3C1F75E39BE7FF19C11BE9B76C85.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10067
                                                                                                                                                              Entropy (8bit):7.983048497893499
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:/W3B30jQGqy2GTeIeYDvt/VQL6w1NGkvv82aZ49cse+44w+:/CYQpy2GTF5/VQL6w1xX8XA5+4w+
                                                                                                                                                              MD5:32B91CFD347F21A1EF6A48E6667BABD9
                                                                                                                                                              SHA1:51A083CBBC4C2A76EFB5E9B663546F6E90EF0E98
                                                                                                                                                              SHA-256:5BDE2F9AE003FC483E256DDD7B1D47DE1A6797DEDB0706D518651338D501EEBF
                                                                                                                                                              SHA-512:1409D2030C5F87C9E019CFF7458BE480DBC09944885B7A43B478ED7BEA49AEEA50D3FEF67A149673D5DA5E8668658DD01EFFE466BD54C0B9CA1966C442AED3B5
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....D7.~:fa...@....:.~.....b.@..<.K.6'H.2J!..$.".....E.6...W......NB.....x.b....5..`>.Y..E~!...Q.......}.n....cM....D..t.....".!L....#Q.,...3.._f.|....n._.Z...../I.L)..?w.z.{\..'.N.3.....I.o.Dt4...5e.I.?/.Fb=......W.R#...N.6.......+4..@.....=u...nup......,TP....g... ........M.F.#...5 ....H<..bH..O....t...@.....>../.Z.t:).5.H.H...q.\O..].C....[`........1Qs.no.~";....D......k..1.Ds...P....p,v./.....R......]....L..)B.3.rL..X.V..1.Gb=_.....x"8.'.Y...xS....+a_..1/.......:0..X.l7..H..j..#...B......Sq.7.a...w ......dT.j..2.f.N2w[%..y..!...L^.**X.Em.T....LK..._.w..*....H".{1..9.~..<".&~..}.D....g.....>K/m.){,....I.&o.s.....R....T..<..@.iK..Q.(.K8$.A.Y...S...%...s..'.M.(.c.F.u}.2.7..[.5........e.....Y.....2...w..._../...1...m...G..o2.....oM....o.H...$...V&....{.:..0.7.(..T...i.c..$...4.r....5.R..U...I..........\1T.........Vxb..TA.......PR........V.+.P...cx#yy....V...F.5.........V..,.....,...v.;f4..Y..w.'.|.....5.W...)S.'/..~B...!..i

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\66B74AA167026A3DCC4BA7064E8D6E229DE9D806.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):11105
                                                                                                                                                              Entropy (8bit):7.9829368889937395
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:4+JIoHeER+G88MsKIkWtZgVgP7NCm/JVShxjCpCD29Mo7HDew4qt5pcAp/ZVcyie:ZJIoHrRv8eKIftZdt/JVSh9C3Dyqtbcg
                                                                                                                                                              MD5:63B22C88CF4353FEE02EAA714AF31AB7
                                                                                                                                                              SHA1:B74485026F3ED251ABB84F223C6FE9841903EA68
                                                                                                                                                              SHA-256:9150E365DC142675C15073BE339C99AC947BB8F4CF5FB438EA01C5DD9256E305
                                                                                                                                                              SHA-512:12EC8A15A11EDB3FEB950D7EA52F11995F9C81D3DEEACF69F9078C126ADAD106C15C927EF72B59FFFDEF679CE0A2FF48053223FC739964FBE29675D9E466E34C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.P.....B.D.3..9....t... .A.S....=.E|...P...P.M9a.r&.<...c.Q.`...o.y".&hw..w..E#R.2......|.W...6.Tt9..$..^.n....Yj..8/..6..D....c...3..LN.X..-l06~5..*........>"..D...d@....f.T...(d..l.....Uj........{......'..5..G.JXt...p....../.[Vs.3s....lRb.....-..f..VF.M..M.uR".Q..]P.+...V....BK.C..F<.....bg.g....cW4d/.r.=.R.r.pa}.X....v..n...-.(......N..+.b..>...S_..6*dS...h*...}4.t....\^..a\....O.whj..#&d.h....Bg.........vS..z..%`F.........6....Al.m.....L............<.../Vy....J..T.$Q..........kx.[.v...>.@#]....>.......~y.`....L;..:3..-d[....sq......4/3?..h+gf..N..-..SmI..;...q...E.6.\...M&w.x...~e...Z.u$6 ....p/..0..... P..sV..n..]=M..Z...&z.j....m"..ZC.k....UC..9p.o.....p.eQ...H.U."us...,.}.)....C...H.....Q.=r..lG."J....FV.#4Gw...%...)p.M'Sy...."Wg.B.-.x..&...c..*.'......8~h..Z..6=.|......~.d..v}...~c\`\...V.....X_ ...C.F..4.......O"anU]..R...BesW.=g.......,.k:5$...3...)Vu.A.2.w......($9.?p..)...|u....GC.b.#..I..EE...C.......eCR>.x.!.&...._.j..i.|

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\6762E24BB9F66A6430B9C774503510453B4EBA21.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):9784
                                                                                                                                                              Entropy (8bit):7.983302644807883
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:MgRteh9FjUstnB47wSM9RbkLdLr+GGlWsi5kzPq/H2zqx1AMOB6kH/+:MgRtbstgMPbULSGGW5kDjzqxNW6m+
                                                                                                                                                              MD5:82CA052023FD57012001D4D531D0B366
                                                                                                                                                              SHA1:A0837C32B615960E6002B157BEB0ECCEE2977876
                                                                                                                                                              SHA-256:8DC868D6A4A7E1244996A45A7E3B449974B53CE685507DD159ADBB39A6C16C98
                                                                                                                                                              SHA-512:EBB9932719A8959AF9F216B2D089809A8CFDE98D00EC768419F065420A5AB4FB30E077A4A088A7817885C4C51D407CCD231AEE12C947A3BF99724BAE6C638699
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..2t.EN.gz...>.B.n.A.....h.....G...|...o.H..M..h..WT..#.|.5@..B..:V..y.p.......=..........%.......0......Jgq....B..w..t.$.S..k...........(b8.C..g4R......P..Rl...u..X..j.F.4..Tt..@r.#?....e./.W.%..p.eA...N.J..d?X..../3...4es..u\`s=.~q...P.d..&wL..j..fl...z....2...Z...n6-.>.nt..fe....K.Z.#.M.4..D..B.....$.sYF.sv..9!O.2P.G.tA.{tzo...fZ;Q...x..!:....}....x....w....m.......\...V..;.n....p&p....D.Y?......Z......1a3...,.WT.5^.wRu..3N....=.5+M.7K.....e..s.._w|..S.P...L=u.."H..+F!.|b...a......Q....<{M..wG..E.m.&M.e...Et5.0.0.[.@.>$ie=.W...j_...3.)..M..!..L........g.^..L..(N.0m.b.(.......e.K..t....;.0.c....Wd.....k.v.k<.....j...e.~.f........q.f...A!+....]..$.J..=.K.H.>....k..........|Yg.T.e`C:/4..r1.O|..LIOUc_=..>.h^.x3.`3.0/6N..&&..CPvn{9b!OB.2.......N..q=J.@j...H...R.F.-.]...Z8T/s-.`\:..}..$.E3C..W..J.'..........._R..(.....Vp(#...y.4.....w,.\.....b..[m..H.D.....4SL.j..t..f..bt...O...Z..j...f.h}..$....$...gU.....=y.#.....`..gf....8@...

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10351
                                                                                                                                                              Entropy (8bit):7.984527627299199
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:08A6jfI02J1A07ZHCnAvfZIMlER5QWiInve1Z6PA4Vsm6xnrOldfZ+:wdDpisRlEgWiIWwx7fZ+
                                                                                                                                                              MD5:6A3CE77E4ED4CF7F62A7C795CC853586
                                                                                                                                                              SHA1:B07FE7AAB682D26AAD230220A90B31D10B89C8F6
                                                                                                                                                              SHA-256:8BDFE1DC0F6FDA6AE6AB090DFA6FE347491AF657E9A3BE3253E579F33592AA29
                                                                                                                                                              SHA-512:E5B1D0FC9AC23865E6836FFFC834D1D696C6D000D5EDFBDD994890EEF485E4B2C4822B5BFEA11403B9ABA8C9236E90F1619C663D92FAE19F5CD62DE34871D5C7
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......F\P._"..*...X=.....7..<...3....3..W.I....Nmg..........C>...S.h..@.Z.Nd...T%.~........~*.J(.^F.E.9......?q...sfq.!.....z..K.@]Jx.}.l.9..x..!CbS...z.6.bSV....|.+.f.....Y..4)...'..*;....l.SW.X....ID..a..F...........#Z.r....7...r..#C..l.2.G.......0q.;1+.'....Q..4..h..V....W...Z4....8.....O.^.FU.....{5.ix.t./@..Z....].......^.^........#..WZ....p.&(....'z=^...F..#.8c.H...u.".to..>..... [>.@../..T.7.M..Rk.g1d6s.8.c....q`...g%.....q.u.....;..........M."....Az......r...+.1..Q.Ui...V.....z.q.\..K...H.R....d.._.}..B..$H.mb?.q.,......?&..S...|.z...'.....K.ty(. .1j.....l8..E.Dq.X0...)..1].....<.A.#..*.%...A._.j.Q..J..A....-..6y[_.]...:.F1T..m.g...w.:.#-.$.z.Pk{..../.]..@...X..7.F[5V..l.Be.~.N..F.<'&v.VB.U..3.....N.^h`UT-.vtA..........f=o....E.]'.`\<.\1.....a.......l.$./..f.)q.Ob...,.u\.R..z..:.g.G...3...-p.}...c...Y...WtJ0L..=..u..X=.<._q.w.3.....l$.m...,.:.../..,_N..D...LoJ...#.f..f.~.e.....(Qx.......hk............TC..._}.. .ek..r.Z.9.S)...7...xK.4.|.8

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\71F4157689DEE0CEB59F0F4068C20E9A259EF1BE.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10061
                                                                                                                                                              Entropy (8bit):7.981485458268704
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:j6kwjAYBBkcfcJsGYmdKdh0kwZLeF9XxgeOj5nqD7Iwm/wIH5fpH3CpXSH8+:jP4LMSmdKf05BefXxIjtAZAfpHyP+
                                                                                                                                                              MD5:66CB4D1CA15ACF59A35E6A27174238C0
                                                                                                                                                              SHA1:777AB7F67DDAA26E4760AA0742F1C52247FA76BB
                                                                                                                                                              SHA-256:ACB909DC44DAD022AAEEF88C7685708B0CB731AB405B2E0668C5ADA4BAE5125E
                                                                                                                                                              SHA-512:6947CC15649B3BC93DAC2F94CF46B483844024ED9D8996E4C12FE6B48E8EF40D5BE4E3B7D3CA42379C3D0104832823989E75FCC86CD8AE904A26D12D054D5B51
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:...f.m..5.l_T.f6.l..c..L..g..w.D...+.i7M..8.-...W..I}T.qg.h.9.U.pe.r...1.......w.n....c|....B7...J.._.6e....c.G=?.)...$.&.]ez/.~+++x.hd...........d+....?F-.P....oS.,/.].N..].}.q...;.3.h..hY^..U.}.j@.C*.5.....#.. ...mJ...h.....K.c.>..?y.>....W...a.].U!..QL.Lh.cN..u.w..(...2.5I{..u.%.?.+....D..]..#...u....Zo:._...Q.Th..v/0..R....G....b.U...(........&..D...@....1.".]..Q..V9%`.........)...4..!.7.n.]..m.:.. ........u."<.]S.m.v..S.V ....@......@yBe..8..R.t.Q{.....}o5.\..i...^.."...y.....lu...f....a.........q...1..............h..L.a.....:..:.....s.X7T(.9..^...&...q...YK.!@.%z..>..z.`8.-O77r..-..g...rni.Q2 ..A@...h..... .. .........}|.5m.z,..z.`..h...?.s.N....t..Q..".S.H.7..)Y..\.s.......6.v.z...2z-....2(..lKA .R7...7...J.O.}]1.......cd-*f.!~e>.........h.%?.e......P&...5.;.....}?$6...a....;..`E.|.5.^.< Q.;=.7...C*..y.k...>`..f..)....)e\.......,.[0..I8...Q..a.3\jc.B.)sd-...X.......7r#.*(..t...-n.....g...i.cZ.....I:.O)....<...X..].O..f...6.

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\7DB3359FF1AE28D679D8DE03A74F2C06BC18D50B.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):9511
                                                                                                                                                              Entropy (8bit):7.979708387557735
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:cK1aWd2hBW8DF4RQ24U9bUF8FAgOfESE3ZW+XMsAaB0kYusaJ+:zDQBW8Z4a24cUoQfEY+XMY7saJ+
                                                                                                                                                              MD5:CECEBC47475E1D8AB812C231896D2CBD
                                                                                                                                                              SHA1:EC887A63D72AA3CD3F2BBD87102E6AA371FA8476
                                                                                                                                                              SHA-256:C0863A03DAEA71095B5E53B44694B6FC02E680684638ABD23BB44BAA7FEAE6DD
                                                                                                                                                              SHA-512:E7000D3354174F564F968438663A03BF1B3B77FE3ABEF8AEFE7238C47648241561C74280C1EA05BA95CE5B29E5420438C172082CA9C4B738959A7037A3004357
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:~6B.j.....c..m.7..."iP...0.^.s.l'........]..........{.s..,...{...H~....L...|9.!>"!....e..2j..c!DI........GH....b.|...B....J..j.......l$.....P(.#....z...!`./..aoFZ....&S.w..1.D........{@#..%.... .8.......h....@W...-.wU3)...6.5.9....RO....X......!~......w...M..a{q.g........AD..Yq>.^.TJ.S.h-_W.=k.`r-N..{6T.9.m...;U;......."^.k...~.......Uk[.....x.....O........k....f...W.Q....\gR...'.O..[Pr.~.".w.*....~..+.mY..........K.b. ..>I.JE......!.....J..A.....5AJ......gg#h...Zy..,...i..+...:8P.{=.hW.1...jv.&........+..n..>..vVa........WRK..^8...a...l.=..T.....Kn_..K..... .V..y..h....0.lC.M..kbf/..:.l.5.....j.kO[....Tk%.v.8.K..{..aVb..|.... ..H`./..O.+.j..... |..7H...V.K.....[....,.....x.,`a*T:.+p;.`..S..Jl3..Y....X.$.=..........+.N.:}_..=.=.(.i...G.......ll...eo..~..m.B..a..|Z....E'..O.G..<5.f+...l;........../..L..u..:).D.pm%.,s&;..W.`.#r.....=....B.<.5.,...86...%..F_6...D.%V.....23..Y...;.s..iA.=..+aC."..@.e)..C'. I#2_J.....ISE.E'...Nx/....b.

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\8226E2CB0DA57E2CE8FC06A4809DEFAE864949A4.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10041
                                                                                                                                                              Entropy (8bit):7.982090468864413
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:upHY4lqb8h4tpb8aF9Q/VznbsrrV0tXNAsKObsj8BXJ0V+hc+:Dqqb8hspb8oeB26ys0j8BX6Mhc+
                                                                                                                                                              MD5:D68DF184F04152B85F5271568D9AE174
                                                                                                                                                              SHA1:91FAC1433120A2682A2059BEF52FF808167424A6
                                                                                                                                                              SHA-256:8D157BF25668FFE0531C280DE45B35930D2C53260BBAE2F229218B0B29D6E486
                                                                                                                                                              SHA-512:E4132F61DE8FBA4767B6D5400C662CA06B3C312DF6984E35AA1FA6EFBECAFEBC12C26D25F287B68D8945C1F7F136328F450EDD133D3C0D97D547E84A2DDD7A31
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:}....Q...)...y.e...i...;\.{).\..2...L..A.)gRq./..._.."[8....@.......4..xF;.....-....G/&y......wJ%.M...PM..O..}..qW4+..>(r=.....L...NZ.....T.W....!.3.^).".....0D..p...Yt.W...,k%....Pn...(...R[..%....p...p ..BCY.....-.....H.S}...o....<,J..k.....W........G=NZ.=.~S....!7L.N.....fN....{w......0..:*VP`...A.....G....k2.@...l...s.xza...nO.\..+..<i&.a..WP......WjD..P..g.V.....da.7Cj.^o.J.z..>m.. .vEU?.p....Tw...n)/..5......o.[{M..m..p..#.8.{.VCX.t1.....F7.<R.....g....'....$.`/...%2.m.....M...m.^....T..q./.S.D...'....z...h...>4....D.4@..C..{.y..3tC...p.AY..2.......g.m,...H......L m.`-...E.A.,....DQ..pi.l...=>...}......S..l^./.....WK*..+y...6.....\...A.......(.-................=......FF.D.....!..KG...$`2..(.._|..4g._@....d;.':....o.X{=c.2.'?V`...e3. L.|...S.7.g..d.....V....5.bmB$:q............;.....&....&..6.,.....@..".LJ...ENb.........]|#....+)*..%b[.~.?......W...q..ev..3......a.h.1.{....N.!.E..=..A...../.j!.......F.....0.5.....~y..fq.."..+.../.

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\882F9563CBC46021B7E6D26FF3A6DF8B530A6906.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10040
                                                                                                                                                              Entropy (8bit):7.9830703450166824
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:ji3SYHsbd05sCDmFr8VnzlLPBca1Lch+8LtSOeMEKL5MSUbf+:+3xsC548xl1caNA73eMEKVMS2+
                                                                                                                                                              MD5:A679B4BB8672604FC5C6FCC90C057E85
                                                                                                                                                              SHA1:1FB7D932FECD7979224282FCEFE84F5C2FCFD2DA
                                                                                                                                                              SHA-256:14F9FDBC179F038D26446A4C883103AE69DD0A4FD5C2A16650284D019338C447
                                                                                                                                                              SHA-512:9223A507DA2D1C697CC73386D336F72F10A979C5CE3710F87B6949BFA2A7A3E06D4DD803F75DB243F995DE90860A49D9097A7EC8FC1ADAC73AD403FF410E0900
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.xh.|..hO9g.y...4.`..n..=..d...k..kU8Yd..|.e.............*.5.0..DCY..M...V..z. &P....E.......B"..Z.K...<U....-.5......mMKN..8..>..-*...F.F. ^..U?s.;.C../...........r..B.DHX...R.........x.N:.g.x..%E.....e-.HZ.P....g..n..bx2.@.)L.g.2S..."tm.a........1...u.^..aq_/.e.........5-..`...B.U.2...]./a.9,.F...8-..u|[..............i..}.>C..kcD.j&..~..U.h.Y.X.......u.?..e.0.Tn{#g.;T&..L..$&.]...6..=.#U..I./G.O...L.u..D/c.....5..-<..>.9..;Oi..W..2jt.../@..|.CQF.6...F.YAiE.X.r.%.".d}.....f.$_.DN..S.!..7x...+...c^..q}....c..........V...sr...S>*.S3.,...zU..M..U.c8.~..K..2~.>h..6.'. j'....a.....:.......B#.%..'...G..U3a.@{..`..>...4.9l......)vA.a.#.8.....n...o...{..r.6....~...........OWbB.7g..L...o....?....V..a8.w...p...)V]..=(...1M.n....&.Z..G....moG...J..e&.z.97.I&.K.F4{.p.#[A.......].<"...9Z....5.d..$..t.>L..m.(..y.y%..a..w..m....$.6...QZ..z:-2.Tk.K...5\.z:U....g..0..z`..~...+.%..p`.."..6.s..BA9....)...*&3.....M....{..4].+.Y.m..W..OR.....e#

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\89C9B59023C6004C5FCA8E641B2BD533BAA7F06E.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):9610
                                                                                                                                                              Entropy (8bit):7.980415175173244
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:Z+3z9zhz97gcn6E0aiEh3InaXQ4U1O8ncRP1cUeULKfdNmsrL+:ZU9pr6ESE9In0MQP6UmRrL+
                                                                                                                                                              MD5:65EDD2F17419AF317E1C1095F3EF8574
                                                                                                                                                              SHA1:DE77C58911CCA880F5B5359C02464966FFBE9D7F
                                                                                                                                                              SHA-256:60AFAA00C5553AA72EB9FB0A6AA32A1A2CC589350DF6FF2023236E0AF300BAA9
                                                                                                                                                              SHA-512:52959DA9CA72C6FC6F98DC61776F501D9E43502490E4EEC4A087F7A42F86603D27CA2CFD433288248CA3ABDAA1F834ED62CB5F60B27A9BA19ACDB763F86A9F5A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:j....br..%nF0...p........4......E..H.vC..W.Y.?.X...D..G..o...2.....Yr|.Ft....gq.=....G.....cm.9..e.\;....op9.Kbx~.X..O........[.f.......W.m..#..~..wD...,.{..s.-v..a...*....~...c..,J....@....]I.H0..!~.........$...*...!.i..8.....qT.B._F.;..P.F....L9........W)...&...4.........h..7...X.L........X....$.V.0r1.4..~54.........RR.).L{.dG(...d....X5...f......3...<..U+...%..=..a...X..s...._....C. ......`..!..P-.(N.w..A"...A....0?K+;..M..5d.~..le^.W...n.'g..P.....g..x..o.=........55c...I...i.o......;..t.C.....Wku.4.q.mV..C......g7.m..$H...~...X.O(.=4R.h...j....jZ..-o.O"~*.}.^8..\.tD....._.t.kz...O..?hf..`..Q....2.Z.q.....H..C......|..7\o..a...c...t.?i.q.>.....t...x...Py!u..s#.~.f....q..u....(.W..ue.V.....8..t.N..S.b...=.V._$.EJjS.f...N.}.ON.%.=V@w...j....t8U.>...A@.gO..#.....Cy<*.....v....#...Y..'.P.p...o1.d....;..m<..8>Q.-...[....O*Y..kE...x..2F....26.(8...a....!....r?..c.l.h..2...)..:.....a...`KKP...H...+...@(........'7.}Y.....q....i..n.f..

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\8AAC17E1FAE55EE2A26192601B20CC4472AF5CE5.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10065
                                                                                                                                                              Entropy (8bit):7.98257047600176
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:WZ438kvCU2JG8X05wqzXyu1HqWnoIGBRwAjoGRfqCv7kWmKJTGIp5RVfZvrpq0kD:B3pv92JG8k5wyhvno9j1RyCvwGlp5bfG
                                                                                                                                                              MD5:169B15E231392F1CC4A01EC5A3A350EE
                                                                                                                                                              SHA1:B4ED60B9D4AEC886444069111F65D8A498C27E97
                                                                                                                                                              SHA-256:C2D38D91BDD13E5C89260F94EECB9B8157E8EF5561A430EBA34405EDFC5D7D3A
                                                                                                                                                              SHA-512:AD19FAE899EE924352ACE47E05DFA66ADC918687781637B8907F7CE10F5295E93EEDD5DF7E5C3DB084CA5B8F6CFFBF278E0813449853FC4AC76E938696A19FCB
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..1FK.rtAb.1E.H..y....>.R.(#:4../.k.@.Vi.^.K../.q.0...g.FY*.zL.m..,.To..<$.VT._.'....%.}.rP..a.?e.....3.4....-.dE..L....._......A..I.....L....fP_..?..X]...?.$.$.\M.'.c.ei>wf.]~..B.w......B.v.C.r..w.Z3[.MR.."0}T6.B/....].e5.~...L3..[....p.X..0&,.....p.nM$.F.u.6._s.-p...O|..xi~.?o.6..F.....Y.......?.5.%dT):..|.!....(.P......y..rU..."[....,.I(..r_:..BK..R...$.....g.Xi.XB.HTr.......=<.I.g..]u0.<.R.-..s..H..&.*...........8#.......a..O.S..<.hZ'].z,|).-..@.m.I...fxW.O...K+..5..Dh.0.< 0....~F"H.\.q..3.Q.:.pR.;2...U.4..%h..8.....I..{.D.!nr^.......mS... ."w.....3z."...A-#..Z..Zr U....y..H..4~."C..U...S..{m...2...yIGJ....@.@k.l ..R'..X.xh.y....;4..)..*.K.Y..o.*'36em..].[.V.(......Y.Y.G....u.,.B....L..Y.k...3Q.oe.>..Dr.(w.\>.&....p.7.U.......lu.t..[.5.L....&P8.Y..w.. fp....%.G..B&Y....T..me.#.=..D ....,.........:....x..KM.B.i6.4.Y.V.....&s..$........y.....r..u..,....I.F..q.}...".....B.#..!....o.M{pk-.nhcE.x..5..._....d..z.=d.......T....f..6"...$..fW..!+..\.=

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\9648808B6C63CD1AAD97A7B68F84F35C95682143.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):9637
                                                                                                                                                              Entropy (8bit):7.9800881174390215
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:djDGa2ceEPNwW/SrCE/PmULWKnetSdOMvGR2EzAk3phUQN1+:D2HCHarKMWKjUwEz2g+
                                                                                                                                                              MD5:2B3B526744D6F45C11D0669447A9177B
                                                                                                                                                              SHA1:AC03B18253FEA1FF6B0A0A8126DAB98C1DAB8190
                                                                                                                                                              SHA-256:23167C821E32BB31796C6F16ECB8ADC490AE88330B4B020089900834AA4B88A0
                                                                                                                                                              SHA-512:71017802F772882869302C4926D387197F9E504AA4264914E0CDAE66BD9BBCB930605FC1C03D803EF3E5F20F16AB0C6443EFDBB05D0CEDC702FA84752F33D238
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.+..:.j.O`l.3...........|.H..O..P...x....[B..E...z.B...j5.......r.+v3.Dp....V....+.$9W...._......`.8..Y.&.....b.j.P...K..F".R....P;...e.;`.|.Jm.5...#`.8..`....R..3$.t.Q.o.f@...w.n...,.....{.:...Z(....e^..wgl.B.s..Z....K+#5.g8.|..!..M...f.$dZG.....6R..!cU...GW)T..".Q{_h.........@....j['8...3y.e..D........t.......!!n<.J.OK......0.{:i0.b.p....\./...!.j<.7...F.3.}66....[..0...V$....>G.9... .%!.,..}.J.(t ..OP..H.q....^.O.....;.l.6o..&_...&_u.7i0.u..H.......m.N.....=...9.....s.Cp.{8?.%.C.0.......1....P.*ZK.d}mn?B......-....V...zW..8.. ..+.z?....y..JN&*..'.......aR3...s.eA2.5...^..2..{LpZ..0.G.....K.->....N.`B2.C|..*........T....$}..Rp...yK..&..Y.ME.V..`.MZ..2X:g..s...i~..9.W=....:..!|9.[...(.J........Kl...t%....rYJ.+'EY....]M.H.m..7.9..i....K..%oj...g..p..a7d<.2t.6Q.8.d'[..u....Q#....U....sR".u..1....z"{.?r>...\..c[.$.7..O.J)...R..........E...+.~..z..E....yW'h..8.P}vF*......Xz...o.,{.~*......Oy...h.......>......A.R.....4...,..h..3Xc..Z4.W.[...7&

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\99B7BF8F4F0080766794EDBDC37140FABC009DF4.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10398
                                                                                                                                                              Entropy (8bit):7.979501260472975
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:8QngXtJsRWX651Ezc5ygyXByQFG/ubifxHuTBe1Y35zUME4S+FnvpJGV+1CBFDOD:8q6EWX65xbyXBlwGifxHuTkow4TvGpF4
                                                                                                                                                              MD5:BEF647AB698F39F1B041EBF7260E494E
                                                                                                                                                              SHA1:A82268DDFD1136CAB1C9C5D5A08F1DB9D4D7FDD4
                                                                                                                                                              SHA-256:F201B4F8FC0E95DE0222CC14FC0A6F4BAA827E1A4D47E4B12F954946F90D25E6
                                                                                                                                                              SHA-512:BD32BDC5CE25AA0C7D4157E45519FA0FD4A24274DB6EB7F88E85CDCA91E4F515ADA515ECA91C8473201792D4ECC466F9B7C78782C0FA1EE890AC98F8847E6902
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:...r...o.}..uP......H+I<)...,A...........HPS..#./.d3.n........#.z.tt4.~.....7B..X.....8.b=..H....f...6.?V....f....G?*:.I,F...!``C......Fr].....+.c. .V.)E_.q7..|._..$.R ..o~A.C.B..\o!`.T....%.....e....Tx..O..j..S..*.8.MI...E7C.....r.4.r.......p.:...9..2QZ...m/.&^...yn......./...V6;]..6..9.0.Q..4.xd:.......P....N.?S.V...\J-...%..=H....5.....F...].?V.X..P.lZ..Tr>Wrm.j|...hg .[.Wu=[pQ.......-...........0V..+...i..x.9<.......q.>m.q..b..dR.J+Dub.J.#y.z...O..g\.?|6!Y..k.x..o.d....V^...KP.0z?.....;..m..V...Q...D..qB...H.bT@......%.....!... .........,......p..J.w.R.0/..3..S4..H~R...<....y.3@./..)..OG.<Ov..`1.R..9......e.......|..P..3..,....F.....s.qf,..~......3................U.6b.xc.%..........cw..>.d-YKv.......#..~...C......... ....,0.....`.<.......u.8Q...$@0.T..........m:.8.;...`'4A.....G..........QH..........[&x..>D_&.Y...v;..8$.?!..4.,..7."R...T.,.Y.gf:me.b.V.? ...U.M....{}/.%.._.B..b..z.-./..68..&D..U...~n..O.s...S..7....#E.1w..B......5.

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\99D01D160AC7ADE6301F3559541FEF1A6F6155F0.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10975
                                                                                                                                                              Entropy (8bit):7.981428516340959
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:NrjY+8/o7NCEmOXx++wsmkmgXKbPC7TEdZmC1daAtqq9HA3RTn1AKkovQ+:NnUcNCEmOx0smbETkZmC1MyAVo+
                                                                                                                                                              MD5:3AEC7097E731804F421E034A99784A6A
                                                                                                                                                              SHA1:A86D827C1EE154AB014068231C0EE93998A522E5
                                                                                                                                                              SHA-256:33790469537A6CECED77B2B6562362A6A91A9ECEC83AE4A81354759404A923A4
                                                                                                                                                              SHA-512:482E64FDDF864092AAD8D62D5372D152EC7920377E615918C0CA8D0058A51F11C2020310483CFDC9866BC12056DCA3B0D437AC70843D5356F7E77EB900F4079E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........*r.8]..t(..(6*R.\W...=...%1K+.....t.R..m.+s.^/t-z&{R..S...d.`.`.=.......+Tm)]...*.~......&..n.1I'E$nV.\....1..G.^..D....Z]..Kz.jY^K.r..&........r....r....z...B.....I.H......$..m.g.'q."............#.*.....e4......Pl..G...../...Lt..C....[.>....6.fM.V..(W..D:......4..]@....^.j..'.E5a.....yaw.3 y3.....!d...9...g...E.4X...7..SO..W.M.+...g.S..`.(.GI.*....P.:....JV....G$+.3..*..r.GV#.H...).+D...S.t..z.;.a{....qK...:V..Wf..:.,.....h.D..^>KT....#.DS..Jgb....w....9Ui.. ......Ze^..m..tpf.BE........A|Ua.....Q.\;!...(+...SO4.Ni.K..U..sc....*6.:......la@...{[....-.KO2..:..xi.......U,1.+.u.6n..$..mmT...Ap..M.....l6/.QB....K..g.k...pV.V.$OF,.h..T.q....+.T...i.......Q..T;.zj.H.n.u.7..\..[.Y...Kh........;8.U...lw...4....W.....4I...wdFCk..x...e ... ...3.oG....wB..jY..d+........@))s...sU..E......G.c......E..n..9.q.m...sH..P|...U9D..#U.M<....?.....M<w.0.:ao...pr...q$.....1...Y.%..t}.9..k.ZcK...J..~}{0.c/.o...r(J.......fw.a8.K.q\U.......0.@

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\A8743ACDA513FF27A72604EA39BAAE662138F0B9.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10575
                                                                                                                                                              Entropy (8bit):7.982971493658294
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:DYnv/GBzTryPLVUwBku1EUEUIKBMB9/IiB/Z3JJL16uSnYFIjdFq8gBY+:Dwu5ryPLBBULG+By8Z3J116uSnljdFqD
                                                                                                                                                              MD5:1424A6D797D8C64432E03EA8D24D8D94
                                                                                                                                                              SHA1:F8EA947FA4C4B009979B8D62D70B30684980883C
                                                                                                                                                              SHA-256:2F66C41EAA390EFB7B9326BEC970E96D5771F787EE0867D42115C0C8CBE2C6F8
                                                                                                                                                              SHA-512:669102F845D416345189A73617FD7CF519EB4FBCA78E50E25CF06E0CC31C0855C6F7274ECCCE4DC63B6840CDB9B9D012DF40F42E14BD8B4B7DA27B97BDD8E9FC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..a4....6.U=.7.H.H2.H..t..^4.....wG..E.pj'..g...T/.:T...+...W4.Q..B..W..&.i.6.c.....l......LU.....l.....f...9.1...(kM...R..y..)1.h.^e.X&..L..L.s..6...|!Og....c..XI!...|..k.].^...xT.;h/+.}2.......i:.u{......su...9..,........b...\h.V"W.....i.wm...(X.....Q3..K...V.?....[.:].....Va.\...."....vt...Hj.&^.&.3.3....h....%v....C..B....K...../...+0..../3:. ...j.....`..JY...A..Mq}w....T..:..w..4$[-.F.J.x.$m... .1...F..z..^...d..0&.g..#.!..V(Z..[...N7.s.'.U....g......{........Qq]....!e.S3i.A.....Fh;j)w.W...<...<S.....7.i"Q0j,e....L..V..~.H.`[...,j......n.S'2T`....xK......1..@M.n.B.K../D..:.4.....D..1zS.'u.4.=.....ZDcS.K,..ka...J.I..LH..QN.m..:T>.9..0.m.K.)......9a....wZ.....S.{b.=...bS......4Pb.~..7'.......;.VU......L..<.n..`.Q"...x..6..X....Nm.|3:.@...{.......i.....M..`uFW..W.p.d.i..\.^\r1.[..q.;..*.B..L..8m.z3R.z.J.B........#.5..!.;w.....P...I.G<..a.'.u.':..c<..&8..0R.....I..8.5.3...2......k/..Q.=.....!0..C.HX 5..;.C-.I).x..JB.'S.9..O.t...W.P.4c{9...x.

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\A8F5B51786B52AA4D75E21BED0B23433A7965AD9.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):15321
                                                                                                                                                              Entropy (8bit):7.988224087544028
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:uymv781PMzx1d5sslwJO4HXPCzkFkju+9XQHTv1zElrBkLFEwPr8iuQbvyfEUOS+:unv9P3LlwJ/H6zgFp2GT858kcS+
                                                                                                                                                              MD5:9732C3C404E8AF07C9C09A2F561A5CB6
                                                                                                                                                              SHA1:3558D1F4C0DAC026638903A22A3DD17DF20B46CA
                                                                                                                                                              SHA-256:0BB4612AF36F524C1FDDE551BDF6476506B70949E81BE5BD0F14C37A831EB15C
                                                                                                                                                              SHA-512:0789827FEF7D9E7CFA634A52D5393FE80B613091585200FE73A7773150C606B28A9C20BD36F6F1962F20A684EAB17B035281072B38081B6D1BBEA2515B907335
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..6...UvS....e...O.....I.M.2......(.Q.r..%....}v.<%..;.{_....|....Z4S(r.x.E:..z...`..xF&..F.*..%....i..l...,.0.v.>....;..$X...F.(./......}+........4u.j.Q3CY.....KN..?._...-HHI....?...)........%...7..Z.....eC...;9d..x)>.....i.F._...ma..{`.......6...DH.2i....;.%..~.....~or....r.E1J...6k..2jh.?IC^..5=A|..84...4..N..~.yQ.......j..@.=a\H+Q..5..%L$.n..D...^.....|d.....7>.P.....w^....E..7...O3.t..;.._.Fe0.Gp....[..T"%L.........H..Vc.f.....E.....-...9.Oe./K......C....1`.....8.%U..5`.+|2)...^....u.6C.r..A.....>.X~.,...6#.N...k.C60.X%.w7..j..xh^,...0..c.H.....&.......)...."K%..I...."DUJc...e......0.g_\......w.....").b......R..a"\..~.n3.`N..+..)...n..........1O4Q%.x.2..p..5.XV...s^.m.....7..?].r"l...C.^.T.....oA>u...e.....b..D.j...A.......e....-#'..Y...bX..-.qD4.P..&.b...S.....B+...b..%V..o>.p^u.~..:...|........1.....h.03;_!...v}q.^.'...*....:....IMr3J......h...iR....q.......W..;j..x.Gi.........1Js.1............~8.n15!..O~..........-.:.. ./.Ra.n

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\AA70DA0EA77AF599D16F76E79A98272BA138060D.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):17156
                                                                                                                                                              Entropy (8bit):7.9890788053913
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:PwgfQzG+kn+KbC3IJWodHhfWi4r3i42j7jg+MAlxT++:POtkn+bUVb54LiHg+MAXT1
                                                                                                                                                              MD5:F447C13546D85A4FC3A1A915311C8F74
                                                                                                                                                              SHA1:FA107F3D321F12D24737516122DA6151963AE27B
                                                                                                                                                              SHA-256:96FBFB94E275761EC18C8C08C56BADCCFEFC116A6A0D2119A237AC30347B3C8B
                                                                                                                                                              SHA-512:6FCFA15CFFD76D43F57709BEC140B5C45E613475E78344A83BBEC621BDAA8C1D6D6039F70EC3052316A781E943D80A30D19526AB4A9475CB235CCD403CBC3F62
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......=.H.-....@.xi.v.......`n....wF.).<o..WV%.i../...@.,..!.jE..=r.....y....R.qG.....qZl....n\..*!..<.r...P...Pb.D.fT..@.h..u...#.GC.$..D..l..g.....S....G...i......8@Z.HN>.Fi.......D2.......-m."+a..7..>.^..TVL.._x...2.h9..qR..R.dn.!}...#.5.cX1%9...n..A......V.(.\p../..[qr.....%|.sx.+.jr.Tn.".. C.[..$.P.S.../.2.%..P".KC.[.I..-pZ........%|.4...GsN&a., b..Y.v.](vL.....8.X.{....^.Sp_q.%..A.$.hh.h...?..%....R..=S..X....n....@..g....2..W....Di...vVw..fc.xB.o...V..#.T]..(?].C..).C.....^A..;r?....R.m.....B.Z.a_.N..<..L.X..jaE......<..y`......V..k..LG..J'.^.O.j....!..S....s.T.....m.%.....[..\.C'|w8...zJP2c..^V.u. x.g.t.R.R....Q..m_b.$Q^.3.?.Z$..".....8:G.D..k..'...I>.lE.Ihmc.M.=..\.8B-5 .h.d[.R..+1...h..d-.(X#.?...t%.*a.h.V......ch..2b.P.....P.fm.6..K..........1..^.........X-.>..*.=..K......nQ...i.{.(P.a.".s.~.......fC......| D1.6..?8...%..D.E.q"._.$,..)Dw^.'>..S.*.......Xgp...t.........D1w..bC.<.i.Q!........+pB.9...`..f..Wj...........z..

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\B964525B23D45DFD792EB4662ED5DFC78F8C6246.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10058
                                                                                                                                                              Entropy (8bit):7.979764116101183
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:tqXeg0mb8mBlm5XovDMhNQ48OMJTksmbYpvRJkmD7v/S/LRgWngA0Vmn+BKa+:oXegomBPvAWO4TusBJDb/S/LGbA0QGj+
                                                                                                                                                              MD5:24D6AF3823218B7E0FC9EEE2B96BADC9
                                                                                                                                                              SHA1:4E6680CF2411B4354BF4A555F2F70256D6514FF0
                                                                                                                                                              SHA-256:46A9A85AC487E9E32ADB08AF41B575FE34CCBABC4A95B6CE3242DB869223F842
                                                                                                                                                              SHA-512:A4461CBBDB11F0EB99AC224C7A9926C53C8F74E0CF8E8B926015E6D993ABD94E9625457FEF77939ECE18F6A2E969323E3D188A8CCD651C48847A5F8374539E9F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:...4).wZV......+..W>.....x.|{sj....P8L.O.s..._/(;....*.oj;3U(.KA.&:...M(./..........9.....4.../.6..aU....6}...d!^.........'.H16f.......-..aiL.U.....X.Dz/..).......M.{.|.x.j{w...K>..`E..i'.E$.z..D2U..e.Hpb...Y.m....:;!..f....%,sf.V.#.eG.ZA..3..OZ.o.....*n.:..<Wy.ab,q.%1.x.7FV.6.....c.#...T.R.._..j...E....<.-%.<M.gH_.< .Wx.G4.....<.CQK.n.vS..Z...^...bj.........56j....,..zIWCVE..D.vZ.P......N..g.M.... ^.Tf...{.a..`..F.[D....H}....UYfWx...n.[...i= '.../...</(h....6t_..^..;@....13z.bJqn./VF....jDE.m....uf.l......Ix.u4..A.......S....?<...|.r....1{re..../&'q?]....*.X.u8.. EhH..2.5.Y...6..-.?....y..W...'..........o..>...P.\..|.<..[N|.t_...@.zN..M]..VelL.D..S..y6K..[.-..0...7...JF2c.pa.@....I.....C....By.*N.Y...>...z...`..%R...IXu.....-..F.......R..-..6r.y..2.^.qX.]\.!.6O.`Tu.....n.g..._?..s.T.Y.}...H.[.\.A....h.b....rNM.c(8k...I..B.[g(..[,`....-40.._(e..o.37.q....T.>.-......g.#...N...p........2p.....A.T...<..l..5C.m.kw.............u^.W.z......J<....*.M.

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\BDE5E55BCB4604200C70FB908FA76903C94590D3.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):126795
                                                                                                                                                              Entropy (8bit):7.998438779269737
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:1536:QNz5hQI21YJoiomtoeR49ujrLYIXey29k0JXca5oPlMXFhvnT0JApG/tLWo9DD:QNDQIiio7idX8Lo9MXvngJApG/tCo9DD
                                                                                                                                                              MD5:3925D59CDCCD4A686E41CBCFACBC715B
                                                                                                                                                              SHA1:7B1F102CA20D0B31FA0B3606BFC5E5ADFD0283D6
                                                                                                                                                              SHA-256:C53DD6C044E715BA5925AA5AB013500ABE1CF657F7AE6BCBEA6C10A54FAABD50
                                                                                                                                                              SHA-512:3AF1D4F99ECC55196411C789CBAD271DED0C37705EFE794CDFB0FDFB8FB23B75805C80B5FB91E5A3E28873CCD7F9F7D7FC6DDF97B27F369C29FA00C94CCA4AD6
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.#..@|...q...H............=.1..YG.....X...V..3ak4..8O.f....X.8....'.T\[..,......B...I...V)..E.....q(c.. G.K.t.Y..@..A./,..?n..{...w=....*>.W.eQ..|\.7...a..>YO.a...<.....F.MB.....(/....qC3..d...9....0...........s........2..j..x>3...l<..|.2.M[.....qvz..%...*.B...vD...`.....\..F...CH.F.0.B......x.|.p{......./.6.d.R.FZ5..D...............wF.e.h..)....T>q.Y....5....^t...l..]....g.G"..bP0.....r)...h..cz..Y..{.......T).]......oV5b..........k.......'"...(.5...,Tm>.?p?.....k.@....QsE|..~3.'+oQp.8........8.....c.-...H:~..>..\.`...'...<.PS...;9<^j`!d."ozG....$...e6#.......ZA..z|.L..Y..B8$x....B..H..#6Y...P..M......[g.Z...M.......Y...........A.....+.o.(.....`.:n.T.BA..j..J.[u9h..i.....<.F<..es.>.....A..T.P.Rv...M.w.P..G..........2..u.Js1.p9.Q1bpbo.u.g..{..x...^.0....[m.qZN.N.}..8........w..k..Z.m.}j.+.j.........W5.6..P..../E..zC..I]J..`.....?.V.h..f.......e8aM.........g9.5..)..4..q........D.....[.....[.....O..X3...w....f..b...=O..r..G{n..L{

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\BE4820D40B48E7D6E96297A9048EAE2279EC43A2.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12247
                                                                                                                                                              Entropy (8bit):7.982827870393725
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:gjrKZq26fPzwPerqDjR9CMDnzPtDFrKmSw9ETHtAPJF9gAGfnoJCY0eaHort0akT:gf2q2634DjRkmz1p79ETNaF9OPoJ5M2m
                                                                                                                                                              MD5:DF6C8D5E9735E4743F15CB4BCB363DA1
                                                                                                                                                              SHA1:93A7ADF90E0838DB45BC8ADC354E7298AE5CB577
                                                                                                                                                              SHA-256:4B76916EB2D15F4E6250E9FB7372D87DFB21474F25914B9DB3B61179B1310A4F
                                                                                                                                                              SHA-512:FC388EA9D91EE47FE22F480DB8B4D4D0A274953FA9D37B6BEDE861489AE95A3A23858F34A93E41A255C22D3EAC0B8B697BA8AFB0E569C5CE835F265001A61EC0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:^Q.v|o..&.)~X47.9x..>o&....j.dr.....D@....)w.....;.o...o.8|u........F.u...c......?.Aj....u.P....A.)..D.5F./.fnc..)*4.?..7..).-.$....Y.".7..].w.TV.Ma.`y.fsN..p|.O9..@#..S)...>.%..lgRyT;...;A)....|.2...F./3.......l...J8R.....0.~...s..V.%....0.Zp.F.3s.Z.B..H.$Cd.{aN9..7D..$.....t.1F.;P.J.A.Tp+..`}#{.9...b..:....N..6 .?.d4K.}..dEl...Z_@..f...5..v`!..$.q.6OG.........7j...=M.t". T.4..wj7...H.q.p.3.[)+...WL...Q.6.....%.."y.....+.58.*5...............6v`.}N..t.?....j$7Y...S.+.s..);..D.D.a|....k...#....OW7..z/.....}.....+...+.;......3p.e.d2..ufc.q.....}ef.B..3.../.H..e..p;...w.=.l......;1.'.!....4+..Eu.R...o.cf.T..F.....6..H.5...Yy..A,>..9.K....T[v.Bn..P..H.N.-..L...L!,J..E.a...q..0:.A...YxV...qZ^.-!Y...r.+V.r./E.ai...vq...<......dD^......b.j+.3..nCu.....h...z.i.-.v.....o.Y..Xe..{m.Z..<...3....;...c........`...........V..........1...Q......4[...F5[D.U...I......1Up..s...........#.e..w.......-.L._8n^.Da.d..#w.U....^W.w...............\...k&R!..

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\C26B0FEA6AFFB80A0EE137492C8CA100F87EE29D.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10065
                                                                                                                                                              Entropy (8bit):7.983651393744201
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:FwbjY4vGxOSSYY21wsbIFV1L99RSMzlWhsa8eUpE9/Vw+:0Y4vTSSYjpIFV1LcBWTEtw+
                                                                                                                                                              MD5:B0010F85324282EE83C59B1BB21CA8B0
                                                                                                                                                              SHA1:3A0971D2A065CA94C13814DE5D7CC950EA6825CF
                                                                                                                                                              SHA-256:5FACB0A99B9C88E809E95A7D7E8F57535491234089C2034F104E06FA87BF1509
                                                                                                                                                              SHA-512:0DE973C92E10AB6ACA683304EDCB22E87D891BD1F87ED4EFE850063EBC7A1388FF0B390FE404B1D2E03F4675552498F7F73FB74350AB464A7C735107FBE17064
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:...:.......1.@'..<.q....../Y....m..P....2?r~.j...S..-V....Fb..4....?......4...o.c..T=m7....:.5[@H.c..|3....G....*.....E.m..5..$..< ...P.'H..c6~.7...z....^....P.., B...(.vb...7E.."...C4..y|};.hn..n.&....~...X.D.k...0..x.5....x.O.NS..>..#V..J,.V...<........n..9...,l....X......).%!...."........../.....1..q.;.....o+b..k..N.]..@./.D....GQ..;./M..>.<.....e\>Ml}.&.......u{...[Z..D.J]R.;&.8PNkj*..."\-2.qt....b4.oB...d^.a.+..b..l..8`...Wi|........|~qD...8..3%j.?_.C7...T....5.W...j.......#....{V.W.+...f...'g..........jK..Q./..k.N.!D...|...R3:=..g..SU:...x.......5...r.qu["..]..,..9..._..2...D`d...'..J..7...Ym.....g...m(68.\..l.W...Y..6..i(....U...~C.............=..Q.z...q...e.sRG..q.b.$...W.[R..@W..@..).^ ...L...'..!....P...d.,...$..F.b1..}..T .:.f...V....GXF..bn.Y?....FE.../p..4.d.%...][.X.............(.c.....c........u..%u{.......P.c.C.&.#4.I..~z*..z....X...C.6.XF.....;(.r....b.P..^g..j...w..x...v...-...d%4.e..tx.|0.r.(..j...

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\C29C07F946FC89B4DE10A21D8C6975FCEF3E2E39.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10071
                                                                                                                                                              Entropy (8bit):7.983341376500578
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:Bu26IXqtu565g62OsMPXeAD+TWzlwtWQcKHxNdzEnGPZu0s0wObcWGrEacicjM7P:Bu26I6ESd2OAABQWp+/s0wYTG40dW+
                                                                                                                                                              MD5:64398C158180E939FE329489240105DA
                                                                                                                                                              SHA1:451747F5E5CE4DFA1BE3FA633F4DD471373C1F2F
                                                                                                                                                              SHA-256:0812C0672CB2971D6C498BF07A64FFD6B940AC9E3FE7E00254515A7E49774219
                                                                                                                                                              SHA-512:B56DBC4CFCE8F5EEE8F7D6C187092C93BEF83379BB2F54FC091A4CC67748C401F84A571F5857624A2459D414503D65B4F4702ADB937F68C034A50DAB25F131E2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..}.R..~.x....[......u@....9.-.I.<'/.*W,.V.;m.J...!!.W)$e.z..SA............r..].#.e...GA^%..(.k..q..C.......-...x$.2...:w*...n....f.l.p.?..~.....=.pv.....z9XY #.s$...>..e..dkRV.S.u]....u.|...W+ .6{.....sI.3e.$...*.kA....l...La.(...^.....4.d.)X}...B1$..;.....Z.0.kn...3M..U....n...qm...m. .Q:..(.]...S.~.5*~y.....lP.|..h..2..8&...R+....&.vM.PJ...z.q.x...3qO...../.+z{..M...-.sT.6..,..).h;:.?.WP.`/.f..@.......s.U/.......~$D.U.)+...1e...XC...I..q.P.....W....apYo.F._.A.7..>.A.M..D....,.....p=......-.K.v...d....;.l...r.n.."B..B.lH..S....g.....U..=.4..TM..(y....zhL.e............1n..(.m...v....d.x5.S....e...b.. |..um..{QsP.~.Z*vv.=*.H.._...K.9%f..-.._....Q.S..&...h..(<..n..u.W.......S...P.Y...L>_Q......26)..E.S.A.E..Y.. `.6..:.X_.v..e#.~.~0.........8....;cA....K.J..Z.<.O....8~...m!>.o=.4.t..~...$..tp'p...([.K..N.*X.%H.)...e..g{..Z..K....!ob.K,..F.2\9...c.=6.>.../.....u...?/.sf..9J.0.....s....A...M."......Ce[..B.Z....I.e..M..3+Q..Q.o..sQ&.@...~PmY3.*Q}.

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\C2C43B688238A5FDA9ED4731822C4EA8F055F683.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10060
                                                                                                                                                              Entropy (8bit):7.980499310865139
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:LDonvgTyC7lTf1B0M0g/Y6xyYmqqe5CWp2dag+8XiLgEIZe+:noYTz9f1BH0eYAA1e5h2Qg1E+e+
                                                                                                                                                              MD5:76E15851AF99EAF769D7175357BAD9BC
                                                                                                                                                              SHA1:9D1CA57F34DE20CE1F700D047F08347444215F50
                                                                                                                                                              SHA-256:8C122F2D8B73F25CC41AAE419E212D6BCCEF9904DF13ACDE8B2F72861DA9B499
                                                                                                                                                              SHA-512:C013594B821779183BD247033ECA7C3BA94555EB85EAAA9B4F99FA71814193965E930D244FD7FD4CDB49BC2377540D5F630C08A6A8A2DCA1D621AF9EF0E54CE6
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..X.PJ.)].G...}tpc-&.Shl#..ql......x.....K..b%....1.1....F...:.n....J.......l!.....Q$..ud..M...."..!....U.6.S...T.or.:.l...Hn..$..9y[./.s-.n.$.^..De."".$....];\.A.d"0[u...=J.p.&u\d5...Mh.8..>.b.b!.w.d...3..r>..Mui.$n1.........P2.j....I|...q]......d...GF..G{F5.....;....>.......t.;.Zw1....A= ...J....:+..(+/I0....s...g.W.......<.l.......9.....[...q.j...d.C.d.P3..z...9.Y.s.._;L.:#.3."=!....De....._.Ws............]n...h.J../........T... %vP.....>}...2H...nT.0......x+...,.H.....hvQ~..z.,.]..ME.N....DJ...H...|....a..a....o...<LU.....-...$.........N...z$.;^.....S..I~..,.v....n.n.ZY...J..\I....Y......Z.kuc...U.m-..U..j....j.......l....J. j.U@....w?...-....!..F..s./..]t..!..`.0.t...s..[.P...u..-.....,.#..0.;......HJ1...x9&&.h.;.".".r.'.$`...G...5Un.T../.0/.F.|.4.3..i.SN..~8..=......sIoP.....k.rn..Rg.....~.u$?.T.)d.z......h.Q/s.T.....a.r..z.x.J.....1IAQ. ....!..0....!b.e.v...fQ.p...6.; .~...|.......m.v.........(.s..\.J9....^...}L.G<.JU.S.EB.8

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\CB58BDD87AB882DAC5784A12AA5FB3DB8E4BDBE2.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:MPEG-4 LOAS, 4 or more streams, 8 or more streams
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8347
                                                                                                                                                              Entropy (8bit):7.980919961640469
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:Kwjo9239NQV+UzCrZHNtitSZAEGYUr+khjQgDBHbnm0C+:Kxka1zCtktSc+SjPZmx+
                                                                                                                                                              MD5:AC0011C69FF73F31FD78D2E3F4E17E20
                                                                                                                                                              SHA1:3DD90BD846666BB461F122C7CAE66EF26F30265B
                                                                                                                                                              SHA-256:EA90D21F6C60725C748861EDB5551C3DB15437ADB59DF1497F8AEF5659088EB7
                                                                                                                                                              SHA-512:1A3E4CEC4ECAF041C6641BACEF464AC2D276991AE3879F33990123CE0448D63322097F38B74668E962FFE2E1EDDF1C46D15F7202A38407C19DB4A39F6F48E8A8
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:V..z/.ZB.s..VUj...xk;..g...U0.2........R>.i.....K./. .<..._$....1.Mk6..._..r...~.._+...=nQ..Fr..N../.H_.N w.a.i..*..g.....7.2x..J........|....w2OL..f/'.{...(@..<...R.(..e.....BP........s2.{{.]]s=.....v..W.C6F..FI....~.U.1.so.E\e.K...M+.......;..r..._..(...^.j...#..V&........JE.T!u..e.......].o.A.H..iI....d^0../..n......1e..Q.k...k....'...V.....Zn...)..4I...'Z..E..D!.&."@0Y.......9GB.R...0.O.%.>.........w)......=U.k..z...._...N.9q.."...5k.(~x.4..;..J...X...Y.Z..q...R.B .u5n7......+..)..F..1....N..-.).`F.....g..%J.9...N.7.i.....m......[.-.t...6..#.i..=..P..7..YH?.:..+N...:9.x^...r..!a...~.H....|.b..%.@.^l.]+"......}..Ig.j..g..l..Z!Nf4J@...f.L....5so6..A....=.&3....I.B..N.S*. ..y.......4....~.....6.K.i.u).X....|.u.;4.p.Q..P4...L...p.../0....5.(...M.v..h.5.......W.$..e-=...v7...l;......+..+O.....1..X..P.\..`...0?.%.E....#.c..H..W....9|..3>...3.CNOB.8..._......z,..f8...].,t.^..`D...{..(....P.........i.../.M.B...3...E.z.<....

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\CDA62003B1B987A64F1FAC75D1484DBFF94F08FB.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):9636
                                                                                                                                                              Entropy (8bit):7.980475529576885
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:ckOly/M67byIsDXz0NosZ/wT7W1xkcB1UldKL3hM8rpIi+:vMIgDXzcxZ/PrUTKl2i+
                                                                                                                                                              MD5:635628113B7932B0E21AB4A570E24472
                                                                                                                                                              SHA1:3DAC12624054AFA0D76477DCF07076C32B9CE848
                                                                                                                                                              SHA-256:E48BB3664942A685B7B510EB54EF5B560E5138185F30A3F6CBD736A9DF501E4B
                                                                                                                                                              SHA-512:0B2C492D69549B139BA21A23FE1187BCD3F54F0504DB310E3170BBFCE2C0A6C22925EA58FF1EC143AC0B0D977DD5B8B86FBD6FC9B98628BBA9A965090613D9CF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..Q*...~RtN..fQ...y..3i..H=...UH|.M...f.?.RW!.......K>l...1.gzc....T.....268.=..P.:..b}...9.[^=.........<dm.J..Kt.^...C....}]....1d..-....U.:F.4..g...O...c1......../..a.j.4.....;.....?F`@....N.g'06.V.+.j........+.<?UY..-O....z..!9....oMp.."Gl8....G+.k.k.....|Z.r`v...Z.u.TV....2..}+..-Jl_"c..a_to.m..9f....8..O.*M...K...5- R.....z).V>..VZ.2.!l\./.(.h.<.S.,.UY.B.%T.H.H.Y'.......u.....d1dj{.D...|.Fg..e'..=4.W...IU..h".'.&J..k...jxE.G......E,.Se.|.=..0...e....w.N.:P.....J. ...L..I.....j$L.s3....}.%d.D..[a....<EX.w,;cG...h.o(L(`.e..Ev..M~.k...,.j.....I.k._....#.j.@..`........S..]..SS9..Yc..?\..8."8..._.\.a..._.............z!)G.5g.]RL..u5.E{.T..i7H.W....FB\....V{.|.s|....".L.d[.rp..V...{E..w...._....>|.S...U6..w.l.....Y. ..a....B.j7A.`R...3..K..T.............&.*T....z~Y.VB.Zo..R...$q."3O..}B.....Hi......7.%.[...s..).^YpRA[i..D...s`...M..Zk.ao...<.daNL...xZ....zE2....2........K3......o*...#.@.......Y......XO.......z............b..5......B..W.

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\D0F48A0632B6C451791F4257697E861961F06A6F.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):39177
                                                                                                                                                              Entropy (8bit):7.9952901068064826
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:4ypwimseYUB+X3RETvdOaG0lemQCZqywDEjlyBt0EULe:4WTs+HREQaFemQGGAlyEEUy
                                                                                                                                                              MD5:3296B6CE8B6DA3CCBDB9089B6009E13E
                                                                                                                                                              SHA1:AD5F0E0BE68179FB2BED4AEABDC5CE1DE5CCD376
                                                                                                                                                              SHA-256:F0B77B3B251D76CFE6E9E8E44443BCD456BDE39E191C739DA663459B5126A70A
                                                                                                                                                              SHA-512:BA7F791B555F256577D1E10EA970CD5762B191AA856E81A6077AD9094B90FB4B50436595F011A8FB618161490AEC2CBD3515FD0C52848E15BA172E35618B0692
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.Dn..%.eh.D..On..._._..B.S...RB..k(JW.z.R..Q5..]......w.PV...6tYR..x......^.n.,.?.:..}..........BEU..;n....o3.........Q..N.w...........?...0...WM}.b..:_V....8..?`.y.....DG .........]..KN.>....i2co..?V..VjML...t;C.+0JO...Ma.....\A4..A.b.1.\.[J.&.=(....)..#.L.j..d.._..+..-.#..../o(..I?.-K.p.0}..6V..Z...%.~.l......t.....T..V{...)7H..>Pu./ /_o.*..X..'9..\=..(..q......6Wkl..Ipw.L....9I i......E9. l.b.I.L.l...*...x$.:Qa.:5$.J8.`wt..Z;.={.H...p.j$4.....L@.Snk.G`.+...QQ.6E...O..Q....".h6.......S.\5.....Tb.*.G..X-.......J....n.7...........Y..c+.R...Y..zz.q.....mlB.......ai...+.....'.Jn...i.K..f.E....4..v........n..6|..d;b+...]...}..T.0.$...|..<..?...4l<...3..z.}.xa.v.$...FM}....m.I.{..8G.K.c.-..K..[....l\.>.....p.:.f..6O7..]..Rx..^...1@w.v')J..F.{1.;..R..].3....W........>s..<[[x...I-.6/.j.....5.0)......V.w.Xe..~.4...0.f......i}....6....V../.H..N.d.>bAod.2....N...4Wo%.<....^...Q].H....H.b..Z..[..b.iy....;n......k.<+..xR......W).Q_...^X.+..a.........%.

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\D23F7952044A1A6016B80DED46FC563716A295DF.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):9658
                                                                                                                                                              Entropy (8bit):7.98241674330142
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:L/cCY23r3v8ViS/+5QxSoZG24QWQnZyIw9EUKGBdE1EB3Z+:7dY23z87IwZQQWpInXEE1q+
                                                                                                                                                              MD5:5F831D42C2D44568B5612DD4FF0AD31B
                                                                                                                                                              SHA1:EAF68FCB33FF4B6479D23173550D6C385ABED5AB
                                                                                                                                                              SHA-256:189B211FD67EFCD4F81F71A78E1C0F0C980F4A063E0569E78C508C382A073C73
                                                                                                                                                              SHA-512:2D458259538D351E86C03A6971F410A0E0EC30FD851CC47A4630BA5EB45BCF9CBDD87C741F89C4E122BBBE83158684739B7B9E5892F39916B00B19A9BA9987CD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:I..BQ.t9.]..4.....7{...e..mI...1x.N^)...p...v..p...m.(.1.....i...p.C...a.X....m...,....J...-...3.T......~.I<uB..lx......H.,..\x.s.]K.P....,..#V......:.....l.e...u.?..G.^}...$gsn.]...!....-.v@.8..XR........DE8X..PV'......'..W..$j.q.i..db/..=...S.3....2n........v........Xh=.^....5.....;{...&....r.)n..X..)...x.Q e..u!&.....F.=...Q.jQ....4...V.h...C.v.Jq.....u...)..N..6..*..2z.._....'..#.K..C.g..OJ`.(....[..........'eaX.....b.>p@B...._.P.\..`.....w....z..y.ecc.q....M.>..S$.3....*..(.M=..F.Lv.p.....FYQnsRz..=.& .{.M..l/K.k(g...CT.e..^...>NUw..Eq.s.;.A.o.T..u.F.u...8.@........L.}...5(..U..O.|....=ZW.4.].i.j.Ns.n.5q.C0..D._bY.z .4..*V....v....X.roy....6i............>Z.Pv...y...#Gt..)...8./8..Y.]....]..C......5Jv..........PL..#......"b....w...........[,._.Y);..y..Q`H3....u..w.>U`..2........P.]\.0.'N.2XF.6`>+`..p.......b....d.|....5.<..........M.n.^...y'.Y.&..o?..1.\s....gEfq.^.....N.D.........8.q.T..1..-...b....?U.....F.".].J......0....n.Uz.

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\D2EC61E8A6DC6F6B45A8D35DBEE8A2EFC553F32A.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):11546
                                                                                                                                                              Entropy (8bit):7.985324562941607
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:tGwGIGULlBn7Ub1T+u+LkQiBiuGVsxkA/xJZf761+S7viRPWssIOlfl+:3L3Ib1yu2Ujx5/rl764SziROssIOl+
                                                                                                                                                              MD5:6758AEDA6EA232337228BEC6F5A511A4
                                                                                                                                                              SHA1:2A4F804A42F13DAC3C6B65CAB3700BC63EF637A0
                                                                                                                                                              SHA-256:8FDB5E55C530950F0F74BA069353637954589BD8649A60B794E9E4B1D868A1E2
                                                                                                                                                              SHA-512:7FEAE1EF99E15A639F6EF07E30D22C4DF0573AF145F2056D18D6B33EF86A59ACDCBE3CF7D7069A534AA55161250A5FB8365DBDAE4112139644C39968A9E59C92
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..^..H../...7..^.a.$....x..;*F...q.5.c...vl.......!=6..{.`u.}.......*.7.!Z.K,......E..y`........@9`.%..2..8......Q..!.u.[..W.3........].....p.......lqK.&..-5!...o..m..X<P^...Xm...PC.....O..$.^.?....+..aa$.......O...=...Cy...JR[p_0..~H..d.U:^`f...A.Q...<.....7@m...L6.....<G.4.N).*xEQ....b.n.89..... ..tc.&...K.l.....)a....x...>.-~....G.....).......I.8C...qq.<.;.[.M.j'...*.........sx.Z_.<..K...$(T...X....'.....'..^.P.][.#I..P.r|.O.g.\ .E3/ ...x.m..7..^..b....<.nb..1T.&I.Cc.C%....Rr..B..Y.......b..6..M7.V.M...~K.+.i.=L.@}..............55.\`. ........T.B....@#...>{.fw.B...N.b.-...c.x.....4`C.Q....k"....#...RY..`i<.K.7..U3..l...n2^.N.F'>......@.$g.....5..lA.)...Z...I.\M.......].....No.u,gM.\..}....z.....<B.A.....7.4.......~..a...A0.L|@.....?....o.[............-....... U..?..$. ..-k...[.b4....j.. .Q.`.....6^....{.l......@.6.y...p..;...K......mz.D....6..t...m.R;;.J.H...Y%....WYa$....i-..`1f.O..).oB~..[.....X.wU.l=....v..vT..o..}9D6....].w.c..

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\D6B0ADD0DAEA00708CBB4290B85CCA0E0FA79061.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):9633
                                                                                                                                                              Entropy (8bit):7.98003845259994
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:Uc+oe03vGshJ/R6ghcAZzFGuMRAVAkt/OmKdy1h5Wo2PXsIJ7L+:Ut7Ih6ghvAuMWVt/OmKdeAoknJ7L+
                                                                                                                                                              MD5:C8A02BC7DDD3DA8031E9DE33EAE29C4A
                                                                                                                                                              SHA1:190C563B88595584BE046E41003CE27CD56F0492
                                                                                                                                                              SHA-256:A3FB1B758CF36AAFDD9F2F4000BBE6EB596D5F281EDB8EBF0AAE1F017E2E0AA3
                                                                                                                                                              SHA-512:57191DC53723F91A18EE6707D57CEFE409FA7216C6DC9ED598387455CD96A03E13E93B7EAE7A886E631974FE3A97693488DDF8FA90782EA71DE58AFAE28315AD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2..(^.... ..s..t....%t...{.&nt.q....P...._.].75Z+.*..j.(..<..".$W-h.1o......1...R.Z.P..b{....7.rr.;N)...)...+,...\wp.....K..lXwz.(K.... `I[.Q..e.t.........4.YE8_H.@.C.a.30..Eh.B...\,...,3..-6p3...C.$p.)8.y.#{......m.i..*.[$0...........i/......Iy.1.._.....N#5. .V...k.......!....'r........RE.0.).....zQ...:..HU.)..I...erX Sx.d%.(p.P...H..F .1`.R...@....R..L>.].I3....L%.s.:.Z...u.....z...z.n2...%Z...b.#.18..9..M..P......".z...;...9/...5..6\=.`"....(..-X.w..q.V..U..y.q.$P.P.......}....xj.{.`.5..1K...c.D.i6.......K..f.......%.I...~B...,".v..]."...b. .Ku~...#\..S......}...zo3.....-........._.}.h....~w.F|.:..lT=m}X0.Z..wc>ay'c_.,...9....bZ..tL:..|.f(.)..{.[? ......D{......,os..S..c.q..Y.u.O..L...T......q.h......NTJI.k..(....d.Z(.l.....,>v..l..>....u).[..d......O.p.$...<....f=.....H...."...r.k.N3.(5U..V..G.K...&.9-...^..31.:.$l....@.:=....%s.ik.B....e:.../..v...P.:.{5K.b0.V<.M..=....K.....&.*<}...$....NK.*..Mb..s!Wb.8P...U.s.lLyRI.y.NR.=R.a.|.?7

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\D7BEEC8C1D80E7AC7310130DB5854DFB79191F44.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12994
                                                                                                                                                              Entropy (8bit):7.987717498240162
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:xzrBv0gvwtV3AdScIj95AhUfuZFfx8Yg3dK4HMqII+:xzNvwtxAdSRj95sUmnJ4HMDr
                                                                                                                                                              MD5:D82D482BFFA4849E5709943E1AEDBB10
                                                                                                                                                              SHA1:3ACE37E59154F7AE1D2AF4D86E2D8CEDAE97C1BC
                                                                                                                                                              SHA-256:95BF48627E9CB03CFEC9F67DBC16D82EF052445FB0B0D53EBAE6DEDC9D440955
                                                                                                                                                              SHA-512:D4BBFE4572FF3BDCFF5578BB7A0B5FC2B9AB21B768EA77686CD441C356E8E84944610B09C93A6D1151546C5A4EDE3CD33118988E280F420BCBFE0C1F20909CD3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.K.j....I.y..X....~...B.....Zd9.x..y*L....>.o6.....As5..P.U.'.h,T...X.....B.B..`..9..YF...1._w..vT?.&c....o..._z..g|.........wvbFk...l5....u.q...Yq..r...hx.s....c..>.......=.@qf..)$../EM:..G.0)......m.'X.......Q#J.;..........=..-V...%.9..>.v....JmYV.c.%.%..p...Z....n.i(.|.o....>.../..@...VB..rK.!@.Gm.j......./....I.g....0!..f...........`.!.Pf....I...xrKKO]Zg%U.n}...V................}..G.4g....z1P.....jq..tCI.R....8.mo...r.XXT.s..o.O..........].5.*.J...>?.'...I}..'."f!....\(...fkBx>..Sb.g....BLi...b..."........"..;.=%..m.)Q9.`.^2.1..x.z.....R.I.N.@..]..b.I..*.y.[?.....&..7c................;p.&.X../0.n."F.H.Y{...?. A..Us..qt..<.x3....Ft.:82Q3.{8..\.....T".=...W..>.{8.......E.:.\.$...r.Vx....4W...iO..JZ1..pW...\..@C.*I,U......0..{.@....V.|.e3..P.Hm.^.....M....M.w.N.IF..}1.).,.....=U5.k..L:. 5.....c1:....$.Z..i...n..^D....*..1..0L1d....,.j.,..E.V(.V6.3O.~.-...Gh! KoMp/..T9...t..#Id....._.UB.E.f.' .......).Z.n-...H.d........>:...N..Ny.k.....

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\D8EF12DD3F5A0B350AEDF5A0EBB7935D12C12CE3.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):9654
                                                                                                                                                              Entropy (8bit):7.981922730500498
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:8hJM16BVMLgmIRaKOS92PheFXtGE2A6vN5yLF97+:8c16ALTId9+hkb2A6lmFh+
                                                                                                                                                              MD5:5741297442D94D389BCE6C3424FCBE22
                                                                                                                                                              SHA1:A22CBD3877831AD1993CEF2F78DA42FB82950338
                                                                                                                                                              SHA-256:41FA9DB9B3953A0570E43835428D8DFD8A9BF669978C2E5B437E9B433DE0A611
                                                                                                                                                              SHA-512:1285382260B540FC98E7B6E61D041048335306AC1D2C7381724E91DF4E9F9EAE443C407EB55DA59619B8E34CBB866661FB350439900BD110ABE73BB7042340DD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.|a.P.R..v.o..g.....Q....bR`..e/...\.T3....k...f>..n....Z...-..$n.@M..T}..*..K..1B...z..qF...P.6x..|,...u1....x.fy._d6!..t(..jzb..%e..5..@D.d.Zz...P.G......E{sn..(..w..j./[Y.<.xk..7......['.&b.L.V..a;._.K..%+..%.^^vo/..,...1...MKz.....G.."z.VE.....q....O..#..K.../.X.......8.'......9.T.e..o...-.6.v.j..O.........Q.c&Y.Z^.|U.u Bt%~..$..)....#w...BS.t....i.>.-.....1....u....f.c.........P..%.E0f..y....:<...z.u.........m2.....|...^.l.#....@l.4.....N.r.A.rU<.%.Sv.)D.|.:...#.....W..~.w[...@.{?..:.|....1.'.."p.Rye.g3i.V...P.|T,.1...5..^o......U....}f...p.....zB.a..n...e$....1.......o....5Mle......R..P4....}Jf...c|........@XL..........h.q.|@...D.YK..v;.:..f9.&..$..f/E.[.....l.S...0R..L3........0.W.&..5......".e^-..d..=FT..<\.6..[.)t.....A..}.w..6q`...98.c.J......l....=....G.PKg.U..Jp.....\.c.'x......p..-.........&..yk+).......Z.p1.7...&...].....t3.l.|..P.H..v.h2...,@.ln.d...u..0..<.o.p..Ox...g.i..#1X.+%..XS..vv........Z..g]....s.....m>p3.tL

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\DED23BB33EA3C88FAD1C0A1CD53916E0D8C424D3.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):17206
                                                                                                                                                              Entropy (8bit):7.988004722353925
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:nPjvLNRWj3h80Syo4KI/YqzhJ1KIEjWgwe1uZeQZ2Wz+:ThRWbhEyoVI/YshQ3c25
                                                                                                                                                              MD5:71F3FF7571EC85CECED387F67A9C0DC3
                                                                                                                                                              SHA1:F8002ED0D944E3DFC226B8E8A17051BD8AD9EAE1
                                                                                                                                                              SHA-256:0AD29AAEBA059107676521DBC722B2E711F0DE7F8B87AC3C7CB380B78568EFA1
                                                                                                                                                              SHA-512:8B93C1F130C226B6837A6DEF9964ACF9E728B42B5876104C4A237ECAB6CA793BD3FB64C2F97BF33872884F73E2117790338DD6E40297BB36DF8A024DF5875367
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....3......U!...."..V......._.}x.9.].)*......:.)Hl.<v..=f..i..........r!...4.&.....uj...[2.e%.^].!bkx"......#.;..z..R.-h....=F|.6.Y..~^..Gl.T....Mz.....a(.r.B.Q........J@...]~!..b..<+$..C....ym.fA.p.].>.J.D5].{D.._....dO.zP.!......R...2>Uk......d....;..Z...+..DO9(.#..f..I.bd...R._eNG.'/w.4.....NY..q..[.Y..{..a..y.Q.2.6nX.]\.b.....h...[...>o...+.*......u.%....l...6A..(aW.?13in.G.kB<o-p...sC......z$.'.>.]..nO...=<.SE.q..3<vJ..obP..w.....e...2..[.|2..).&..L.58,_..?...o..!.........P2.9..BB..g......m..<.j...2.....O..o.XW.=x.6.vJ..&...^..h.....H.\..$9i..4..B3..4...}..}.oE..`....u.....a.....M....k..}.%.,.....aW...C.w{oy.]..%.}_Z.JE......:.oz....Q.pGf.y.R..P....=...i,...fx.$..zl.2..c....gx\\.l.&.....Q.=.m..3.K../]@.M=..uW...<...(.B.G8....t....9.....QMLJ..x.e.....%..'....).0.G.......X..!7.L....+...e.(.a=E.l..t..K.V.%.3=qC)....^a....L|P....$..l.=..k.)f....04../.;E.`.P?.....r.~.f$..V.D..._.w...._1..PX.W.R.gw.,.9),b^8e@]x8.)|....\.5b...-..#.IC

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\DF0CDE23AA0F44779E78EFEDFBAED16DB1B4DF40.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12424
                                                                                                                                                              Entropy (8bit):7.986366278563066
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:CcLK4YID1qAS/OaY8VTQ1aMV1aE4qcj+1+:3LUID8Jd81aAaqc+g
                                                                                                                                                              MD5:A8B101F4C0537D65D91BB4BCE6DE4BCA
                                                                                                                                                              SHA1:3382DD505E963C2902785D976FFD499FC0948679
                                                                                                                                                              SHA-256:4127C1F70093A4B184CB8B0D6786E6B3CC993E624234D6C8C7EB30FC614CFA7A
                                                                                                                                                              SHA-512:63FCC872CFD4992C89016388EA3B0C5C867ABC58D0E326FDFD65E49CEAFC8A6553325DF89B23E2EF90D5584DD866BD5B311BFC3B38CCDC804EA431093934D4B9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:U...,.Yrf.:.q.e...Oh.t..~IN.A..}:..n.z.1.a...'b.../{m\.I/...\..)......4&.....a.-.^T..t...i..........~....@.s..z.A...h...K^..z.X.l..E......u.S.J8...u......\.$,I..`.q......6...{{..U.1@<.$1....@.lC...m.......3.+fK.....1l......!...@i..x...3.v,g.\..^.i#.$......g>b..,..:...`..(...C.M./......]..h..O........=....p.@tS....z.a.U.+J....`D...[..|%1I....RT.iS.....;.Y......vc...#x.O-^g.HO.7....vn...K.R|.B-...U.C..q|)EC.._...........].G...4..k.=..,....Bm.e.);0.....M)?.c.3..x...G<..h...:k.......~Y.4.u;..p.......7.U.6[........0..l.....V.M.o...C.6q.~."$.w....'..........E....D#....B....../_........K..h...bI..t.7..Pa(X.X.5....1..&{.!..t.Po.9......%...p)........`.!......{....z..#s%2..2..X&.YD7...;...|Dz@.SAT..v..}..#O.M.[.j.<.........<.......O.v.;..%.M. ....QF!..$I..b.Zz........;[.B.RY..^Y.......8+.T....d.q+.;.?t\b....$cs.t..sh...a.)g.lK............H.......`........Z*.6X;..W.E..i....Mqw]....#..tz.>a.J.0...h..`...`.!.B.....`.v'...5..,I?^S^..M..''U

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\E673CA89D86A2DE6C94ABF57948CBCA43E7B8EB2.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10061
                                                                                                                                                              Entropy (8bit):7.980907588111926
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:zA9cRmAyRzoKZUNYxWU62gj3wcyZGWj191IHjoh4ZfeuH9ZsLHMdMIXwFf882r4+:MlAyRznZUwytDxyV191kxf9Ho9NFf882
                                                                                                                                                              MD5:E635A32CA8DE6E11587EB0675C632133
                                                                                                                                                              SHA1:88C238293EBA52F255A0826C2D599BAA4875259B
                                                                                                                                                              SHA-256:AC82E4A95EACF90B705821E06BD9C8D001A3CC10D2F738423645DF08F2610D75
                                                                                                                                                              SHA-512:2DC7B38AE47439B9B8E3FEE9C6227F487425DD2334FEDED30EF999BC0C0D53F377CCCAAE67E2B9633E4AA71A4E140D3FB8E121B8C1AC92FD8366263DEB841DDE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:\J.B.....2...rs ........^.C...R....I...C.'...(~..r4....@..n..m.2....m.d..\.[J..Ux..C.,3.."..?g.7.:.eR..r..>IY...!..=h..IX./y..o..E...0Q[}.]...d..:..)..T:.U.'.-A..N..*.C<.w:j....?.e$5.q.v.7.("...,.x.E._.oh-`..M...q...K0u...a=,l........m-t...H.L,.......?........&..w..V..".Ktp....s...|....o..6./....wX/.U.x."9......D......@wD.."...fU.B.........Z)........kZ."..).Zz..&R~..m....U..+<....T..-Lz....c:jYl.R.$.a....9+Ja.XLh4s..^....\T....D..r.Vp.&.n.a;.vui.-..|tG....V..T.....,_..U..?...v4..1........,..|...|=...oO.Q......dVu..X.b.h.<.5s.j.W....pB'l........XZ.I[nXH.-H.~X.$S......!..Y...!....2..".5..Jh.82....-.vv.t.QF..-......Q.b1..#..../N..Q.\..2.OU[I.F..R..([..a.4p.q.{......?U.......p.p...J../.1d....P\k.."...2a\;.9a...N.h.Qx..x....#..P...vB...u.N.."W^..sr....)..K...g......_.....+~.....+.9..[.r..nF...6....d..$.B..L{.tJg...T..!..u`...z..'.G`.X...B..C4.."*.H.l.;...."}.......B..-.....\.0..P.W.[jF*.......<..{/.....a..ce{......x..JU..4..wY..P..

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\E707EC8A256322E87908664A49F800B7B48E0961.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):21316
                                                                                                                                                              Entropy (8bit):7.991559750921321
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:384:NE+F09KcfZswSButgde6qHnGM4kHg3BSYgHgTyPGsFOffpl7BASnRb+:LF03iogWnn4zx8PGd9A0R6
                                                                                                                                                              MD5:C0BFD1280383C6EB3EEC916E90DEFE72
                                                                                                                                                              SHA1:7ABCDAEB7822D260F0D9453864422F09A578A8D8
                                                                                                                                                              SHA-256:F6CD9579B60C583C6063F0D52AA14FA28DA0A2EFE9B5FE6D25AFBA1FC3EAF622
                                                                                                                                                              SHA-512:C69CD9914B01CD2482C644AB9F18DF8DF1B32583257D5A14E7BC830AF7F34422B8D0B7E74065FA72227D3D4135DE398C313A326ABFAE7F7A4FD4F7D8534A693B
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:-..%...1...oN..R..iJn..._....v...G.....j9Q.{h.Rn..=.$...1..G{G..C..3..%7.".D..r.;.8O'a.1..N4.C.O.FA...n....)_./`.4....E....R............P!..g......V.tb...l..A......VH.q..Nk.j....7).......HY..1..~N#...5.?....Up7.......\4...B.9.-/:r Y.s..r....ss.@..%.... ...v2)...C).....Z.x.u.....n..b.&*.|..I.f.,.2..Ra..nI.u.C....4S..t!.:...y.,..J;.S.e.};.y!......y.H...'...6....T.QPj.".5D..1...SV.`3l=.....u......qm...P.!.c,...fn..m.>.........:U..Z6..~^f...".....].r..M..q(...N.0..3....kc.aV...q........P"..B...Lz..&vS...{<.a.....h.LP"A.CE...]F.(*K....!..`W...H......^...,....F.`...Cq.(..]kg...A=.o.qq....[#.J_.{.i.z.............W...^vx.E.7j..Xe.9..1.X....v&...5......PAIP..U0.<w.....%.-.!......:.....2S.L....-K..K..:.-..3O..D....%.;.c.)FS..@..u.j.k.z.....?..Ay..W.My...C............;.%..M..C..'...r.`...x...5../......@K.....=../....2..[d.?.%Y.!..M..g..-X.-.+pU.yE...b.?-.p?....7.@ `<o.=.......5...kg=f..cp*q.......m......V.U&AG...V.......zQ.PZ.(I..[...I9..S.._

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\EA1E3132006CB34CB9058E6891C35B731B9C4D9B.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10600
                                                                                                                                                              Entropy (8bit):7.982809283618529
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:Fltz0xscl+KIRRoUDYSTOz7OTN4KTYyIIY5nlicxy6oU72aj9s/iCfKncFplpP+:FT4xLl+KNJS3TWi5ylicxyfYymcFHpP+
                                                                                                                                                              MD5:E3954DC147C3DAB6174B6D29F7682968
                                                                                                                                                              SHA1:FEECAD2AF1D88D23072BA705974EEE1683249E1A
                                                                                                                                                              SHA-256:01321202DB72C6086B3552848E5EEAF8C285383BBAE8AA8DEC843DC2D14E1D14
                                                                                                                                                              SHA-512:BA1D948E19AAFB12AAC941AB715A88A4B67F6C004B8F45CD46A72A98C420C8670BAC536C7FA687E493E2762809A643EE96311492A37B5A2A164EE9E78AAF2582
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview: ...W)..-..<Q....."I.y....Aw.+..J...X...jX..AG)0.3....R6.S. 6....LW...0..L.O......r..qQs.+.&ek...Z.6....G.=.@$O%.}.?e.7l<.j...a.>5........?...\J.$|W........P.........-.>.....^...~...>.>"..m......e....r...5...2..^.t.uE....J..i...4.{7@.xX'3.w.Ca^c..!,\].-....<..<.p.n.<.s....OU....r.......`Q..F.Gxc.3.Lh.b...j..f...{~;..h/y8./F}...V.We....$S..c.a...L.,l.R@....='.RH%...;...l........'%=...A6#K7.OR.{@...(..h{.....B.....-..v.nB...f.O..2....1......G,v.....R6..hs...c.P...\..F.e..&..N.S_.gI...4.....n..%..c8..........j].]e._.C....Y.O.%K.(6r...$..m.....m..P.U.....W....a.sA.m...r2e1....Y..a.....S..].:#n..o1[U..K.S.~.8r.......$...D...kRN.%...b.3..j.^.;.=....".D.K?.h.R.6.@...&..My..u/....>..oo-.x[...R......./..!...xl..9!Mi.6q.....WIZ8^..A.;T..ci..]z.k..qvR....i@.&.L2W..I...AL....Y.c..;...y.Lq..4*..t.L..~.z..........-.N}...6...i.$..\..V:.D..AL.@.1g.k.....T&.j..Qvq...8}.:...p....~D.w.u(.....0n...}.U.0gJ...M_.K.'u..\.-oQ..a.+s..f0.i"!.:w.)%.-......XK...

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\EDE675BC5BD66B9EEBD8A46A4C06CC47C388FD92.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:PGP Secret Sub-key -
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10622
                                                                                                                                                              Entropy (8bit):7.982619417218682
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:GfesC5vC3NQ44A+k6Vli2uEP7Gx0gc+rFa3vJiLsjiwr5/powm/zAPBEk57u9dRc:GfeDZ4E4ayUcOxwsjiwYrABEkRIdRjz0
                                                                                                                                                              MD5:3D513A0DABAEA37F23EBF4D66311CED4
                                                                                                                                                              SHA1:1C50B694BE374A3DE70ED0D161305DF9F51630CF
                                                                                                                                                              SHA-256:51748C83948B827202518387679333EA2B11FA61BAF7ACC8A649C9E20C6CFA11
                                                                                                                                                              SHA-512:1CC93A184A4D73960E95FE76F294279D429979E28B5323ADB9C89C38BCA1F742C18E0B6BEFDF1B2E810D01CA95534B10850B6FF4A4380E4786262845C060E68D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....I&}....f.U.........4.....VtDw7...>......"Rw..LP.......).N...Q.1.,`.....=[=.p..k..,.1.\.z.L}F.....R..5.,...D..#.......2.c..l........u..!...;"t...4.".I.gmf.{..c.MT.o..<.Y6.p#..o.4)..:.!,.....>z......g..|&X..-..m...#.h........uv^#n.T..k...JF.2....~x...".{..=..OJ8..5.uha..;...ev.....2..2..Z.!.R.dsK#Doo...Q.'.b..bM%u.3....s.Ex..%...E..^.N......V.Ko.4P<..n|..>.a..,...4.D.j..(..M....`....]".Be...E"......Rw).*Z.......3.8...#....&i...$Ol.>...E...$....`I.7.G..S.t...._.G.+.....*.U........;%..1.......'.,..?.~.o%#....|Q_..Y..!*)U..*..y..?p1..k...p.....i...M.4=.1.|..;.e....VR..9._)r.|....h....."..*.T.0..%.=.S.m ..k....(bF...H:c..8+....+.}.--.D..Q._q![WS.+q.....&.b#..t........*\.r.I*I.xs...2.T. =N.%..r.....n.....K;.6Y.D.....2t..-XV....E0.f5.........Frrg.xd.....n....~.Sm...J$.....h....g,..?L.~....+=..h..[iTA..o..A...@."..|.W...,.+.1.z%6r.*.r5.....Yx..Fn}_k_...z.....=o.8m.......k.!.\2.r.g..F..8.?J.%......0......3SZJ(.....d.:L.j..........C.R_0..H.........

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\F8CBD54DDA10F4286A41EC6A537240712D6C2308.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10166
                                                                                                                                                              Entropy (8bit):7.981973707752429
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:8Or0lYDW/CXjArJA9BrFyAh3CKYufRKdaxEufMEEaqd0+:z6oXsG9Bj+qiz3T0+
                                                                                                                                                              MD5:06ABE776AD88AED80918D00120C2DD19
                                                                                                                                                              SHA1:11F5A9051D1A5F60C5F1389E1B6703F2B88077DF
                                                                                                                                                              SHA-256:8A0B1C40B80928873351A308483D009B867418670818A48A1904668E6CDA3E3A
                                                                                                                                                              SHA-512:4283E1F6DA643CCE1C5CF8BD1213E07C4F51A5973A08CD52AC1BAB0DD06728C82F20BAF2DFF55CF45AE4146171A2727311A764990F9A4166C0DFCE1C17DA0BF4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..`.....P.bq......P.....r^.Uct..[.X.4~...2...3(I.....i.3..M.t..[...Fx...'....X.V...)a.....-G........._=..i.....9.....a....`QF-.4.Q..B..G....mB...w..@P....F`Jo..Oq.......-@..u.^5..0..t.-..X. ....K....z...B`.&....W:.S.~.M.Z..^z+.Y.]...T.p......tl...m8..D.....8..?.+y.jZN.<......<..&.....]....5.r*.._.)*.`-.q.5.......d.k.8 !.].@.Vn...'.5.{...?...vG.[.X.+.."_.....2...\.1O..aHh4..-...L;..6Et.BB...%b.......!;s>ld.M..Rv..W.&/....4..BrA.wg..._...n#..\&zV........&.A0f..A.-..YS.......P~g..[.^|.#....R..O;Jg`..........>O$}#Z........Y..>p......(Z+bV........4e.U.]..(UMS.j.C.8....Cd.......(.A.b....|D..b.o.|o.>c@c+...$.......H....y.DK..m.c+.s?.X~.......H@..."...D.gCh.d.....l....$.v2..e.%X.....=..y.z....oW.....l%.:m.3.M..M..$P.......:.....vY.;!P.3.0(.....w..|..x...I;..L.Y%....n.F...?..4..Zx!&..:...P..d...;..o"_.+...7..D....b.+.i....;..}...ei.<&..$z..K..:...2[.....CU.I.@...x.a.{..V.P..kx}.8.......g.9G...V%..u.....x.hh..QQ...D.u(G5.*...0..u.l....

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\F8D5B76A1EF679D7E128B67E60239325BF22714D.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):9539
                                                                                                                                                              Entropy (8bit):7.980986414698487
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:otCY4apQR1NxwOMMMEXw8Bk2YjwuGDsp8BduEHsor2LzZapoPC4OnBokZl5+:p7VRXxwOMoAek7GG8bHsLVyoPC4OBogM
                                                                                                                                                              MD5:FB574D4297DC560D82F44B5AFDBB0261
                                                                                                                                                              SHA1:B3577498B6F9BEDF88ACDED81CA5669464C435F8
                                                                                                                                                              SHA-256:426C229DB2E597A875F2B617075BD0C10168C14F578BA6FFB771343EA9E41B01
                                                                                                                                                              SHA-512:C138BF71582152C7D540B646C9413C5D9A360DEB128E2DE3EE81C0FD93E422C0B5FDD9172224F6C775182272AE78DF6882E787B94132E72A940C0BD53588E909
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:...D#..3y...n..*4.feB.M0..6....Bf.......T..W...k....oq.C..VJ....?/...../r..7..BT.r@.u .....u....IHg.....>.#)...>[..{..5%R.V....#7"........4SS.B.c.W.I._@;.....!.....P..^.....M..8G....V.....]'s........ah.....N.$R.e....v8..K.b..<Q......$...0...c...1...P.*....B...w..(.[.......&.py.i..o.......<.^...O}.....l.....(.H...`)Ok\M}.%.R...........5Z.9.......s..)Jv...../... ...w7.80.4.++.%.%.#).`.g?..z....1z....F..../.Cd.6.].dD&.....S..'qa...}.^.e#..D...oC._L<.%.I.F..Uo.Wx.@... ..f...[?L.....S.-..2.K..0...'.i............?...@..!.OyMT.U'.8.Y.._....X...p.;2...^....=..LQ..N.NNKam...o"...(....aQ...Vp..{b..(Y.c..o...|]......./D*....x.qd6....L.n.)?/..W.QSno....+...b...<.f.qX....N.8.q...^.a.....s.iY.#..K.9Y.2.....Kp7..._VW..,......~....9.d......n......'...n...F.<=D-T.qu..F..{.2..\I...F....Rd.....!"..+...Z.h.s..a0......,..F..r.A..Vs...XOJ&......X.;......H.$.+..n0..9.{.....'..$.^.p..../........A.lf...Pn.#..\G..^#Pf)@.......1.B..pg....4...|......}.....i.@.d..G..

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\FF63A96CB0EE05C4E8600CAFADA617EBA0BAB35D.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:PGP Secret Sub-key -
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10073
                                                                                                                                                              Entropy (8bit):7.981059644838492
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:Fqkn+iR0yHoMU9g2mqRKv8YvzhQ0AjYvom21as1VHSANKBuh21xZq6kzX+:we+iRbH9U9FKXLG0Vf215ZNKQYxJe+
                                                                                                                                                              MD5:CC68F9662D487C878D46B69320BD875F
                                                                                                                                                              SHA1:948CB506E89C27E6941186B0A840AEF415D04D81
                                                                                                                                                              SHA-256:91E6F02D1FAAA461A17827199868AF6A398C38ADDE40F224A77D18508C0EBE87
                                                                                                                                                              SHA-512:FB65F1D7FDA784EAACB882EA4E28F477633D260C93C8079402953A21F537D8ACC2D5B57DC0A76FDFDC9B3EA7A815618B1D41313836B7E4097D82A1A0BBFFB50C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....Cy......>.T%PE.a...3..F*......x..2....<..N[...y.tD..O.......X..../B...s.....s....s.qDE".s$.9.J_.zR.....s..............\.j.E...6y.2B..`.D).B./.z...ZB..r.....+.^\i.............w.{.}.{.0......JH`..|...cH......>.J...Z:......:F.+.b....+U...@.|...L....9L42+...E..W.....4....K.M...LtK.1.K."..#..^HFR...PJ4g.C..{{.}<8u.@...<.B.4i8..z.|...eI...&M.H.!E.*...d......|..|..`L.U-...QS6i.7...i4[,.#...{..>........a./...I.Y.Nb....#}E.r..)~.......?BDP...p..qH-g-Z..=N..n2......S.R.-...K.W....@..S|.....Ym..=.).R.O@.*...$*....N....4q.....,.A...R..8..Te.?2...m..8..K:mQ."..%/..xh...b.P..U...`4.=.S>......6P.......|....&[v..\t.g..I.+t.iR...`#\...?..L..+.7.=......~TFlD......P.Z........z.s../....,xg.i.8.o[.....a|w.@#1KFsG.8.m..W.I...2.C.c0..E%..7r..(d.......E.. .Dv......0gI..O.]...%.[.. 7..cLx.@.}fRy.t..y./..T...P...kLe./...y._7..z...2...I.RE.N.p.6..bI.Y......gv.......|o......?9A.,_....sy}.}?...$......t..y...p.M...n....^@...rg9.nN..A...?.eC.0..eA.].JD^R.]..4.we

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\trash16598\13723.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):39028
                                                                                                                                                              Entropy (8bit):7.995870861401408
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:zCHXbuxqlz6SkTY3dil9MTObRvlBskZwKrZ3r31n2tl8p:zCHLuYlzKc4lGmRvnrZrZ3TYl8p
                                                                                                                                                              MD5:0B7797D319652DA2908038AA0D95F136
                                                                                                                                                              SHA1:A69E51F56F057EE555669A99186FCDFD63230C61
                                                                                                                                                              SHA-256:26CCE05FF0BC264F07484025F5D9CB9A30F011C056FFAEF190D46A22B49A6E1F
                                                                                                                                                              SHA-512:67B6BA53FDE9E25A7293AE509616E4E1BDE47262DE1B0D48DF240E84843849FF9FE83F17E4C39DF26B6F1580E23925AA6DBD9EDA8B4FD62AFD0DC965C511381B
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:...$a....P...o..$.1.'X....`4C.P/.z.H?G(.`...Q..t.*.qUb...w\.c].*..'.....~..+-...@.. .....^../.5/Y..&A...7%..........Hk..6.pVm!..N..x..<O.#..;.Y.T....l...B.j..M .4.o......u.i.I.m..q.4....h.x...|.~.......`.$.....`%6.T....PW.\.6...=...^.~+<K)..)...%}.u.z...{.....6|..`.\M.u..s./|.}B...L%.../......A.WF.....:.....ua...G..*L.~b.7.]....8T;o.M...|T....C......5.n..j....4&_z.Ox}.%...6.P...=V..6...TF..9pqA..W...@..Q.)k......@...T.......P<.(.[@..c.\....{$".H......F.|v...1.n...]W....oU..M_.r....O\../S..|Q.x....,..pCW>..5.+K.........p.h......o..R5...yt!..<.....g.......V..c...\....#_.I...3...\..$S+......=.Q.7K......-....i.v3o..H.x.X.,...l1.G.........=p~UL."..u5..."i...Y.m..... v......>.G....f2g]4s..ngu).w...47..2......Z..1.|EMr..@..U...r..e.y..Q.A.r.G..iZ/./.....vB%.O..3.(+2..y...Z.L.M>.p..Km. .N.^R~..L.&.#...."y~..R._./z.s.B..<.@.98.$.....m.."h.agz.{....%....(i$.AZua..'..|.U..T.`@p.`....w..~..qnZ..),..9i{.5..Uqr.+...s.;.E...n^.<)."V.op=.....q....;..-B..I.F

                                                                                                                                                              C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\trash16598\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\Settings\settings.dat.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8431
                                                                                                                                                              Entropy (8bit):7.9775836526647605
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:30W9swEbiqADAAZHqL6A2l2XTZSBULOsoKQmcRiJUmAF+VnFKJpt+:jWPb3ADTKBa2dJbQmJU8tF0/+
                                                                                                                                                              MD5:0B6236AD546D7A6BBAC9917D45FA0373
                                                                                                                                                              SHA1:D7C054DC06DCC99FBF6E5C40F2CAA9FF9764D652
                                                                                                                                                              SHA-256:A2D97364C4238BAF580F7782C3645A442A7D2007F7DD47970E93CE0C42ACC164
                                                                                                                                                              SHA-512:B7F5169A89A42BB2B9F5285A73704EB55C39666580C396B5A281F79753E7993F667F0A63C8F782408227282A32D5DA87AA8E38D53F4A3D8021AB709FB06E2C6E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..A.0........F.Ml..H./Y.^...V.*c..I]..~.Ad. K.h.Y.q.....1Uc.O&;K.....*..\hE..*+..R.ctP|..[.)....E....+.-.k.....P.R/Q*l....!...m......7....V.e....X.....@..*..H*oe..7k.=....hj.Fe.W..eD.h.....]....\..._..jI.\.:.4...a7.`u....."{..U.lD....Mx.....V!._.1......_bM...b?.P...eHY.K.i...y.<'.LR..Cxh$.;G.........K.K.s.o..5.>?....2.E...R...`.~...~].g..../.@.JM.n........D....j&.....1_...|.A.}...gPk.....~|=O/....../....$I.)E.="..\.....X$....q(..C.n.6^+..1...q......L@...{.K-.p.....s.,^....\..G..L.......xt..Q.2...P...,..qJ.W...[..u*..F.1.R^...........a.Z........B.s...t...W...?g.#..1/.2e..$d..a.6._..[.X..y.[...Qv!/...#..!.|....U.0.0.)<..}.Z...,..M..(.lB.Y....k%.a.fmu.j....:}.g}..yFO....%t.c.8..adX.fTZ.x.5...>]H.y..g.....^.......l..YH.*.1.......z....t>.$..=p.f.^.G0..z.gN..r-f.zX......L.E.X..X+..C?...1!..[B....N.... zvjp...8.&.8*.7;...y.5.y1.i.8.}....+...!.`5W.'.....m1QH2.T.+...[.....,..,...}.......e....O...Ul.......k..(.B... ..W..&!....Mb...#^f.. ..,.\...\

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\Settings\settings.dat.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8431
                                                                                                                                                              Entropy (8bit):7.977152514730184
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:wwwyvIOQ7xAWUOeUvLUZx26C7jnnSdizGg02HV2e6A3g+:ww0B7/UOeUzUb264nxdrH85A3g+
                                                                                                                                                              MD5:523AC64C8CB03C9287DB8AA9288A32BC
                                                                                                                                                              SHA1:2763C47731C329B8B9A350F737AE6D6CA5A101A9
                                                                                                                                                              SHA-256:C68EF632BB3F765D6BC2484A33FCC5BA0C4136B9EB3234AE67F7886C8B3DC278
                                                                                                                                                              SHA-512:854C6D994AD856400133E0A67950CE7108AAAA22D23FF424836173E66B8A564B12310ED0B078C45472FA0BF4A63CE2F49958E709B09C89E9AE809581E77AA649
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....v.J.X..r.....{+......(w..........7...u..n.L.RypR.*..Z.*.d..,..^"...[..r..}....J.....6e..=..G...43.._.x.JW..s....1...h..Pz....8%...&....u]...P......B})g.2..L........j#......m}..1.W.@..)Ko.t..#...pz.]|....*s.k..y.3,.KYEW....-.;)...\:...y.#..JvoP.].L...-IP.r].J.i..T..L.2["..%..8N..C....'m,1S ..Qg.M+f.^G....5{.7H.wA.:....\n..W.KV......J....B;.....:B;.#.5..4.iA.......V.3.d.P...,L..hV...Y..........P.....0.t.[a......h.G....U.e..jvi...i.R.?..-H*.,T&...\(wB.+.N.. ].g.$.ja.}.x;.I9.2.!.:...C.QH..yyC....Z..'W.S.......$.....c..P........!..*....2V.p.Z..>H..L,/....Fk.h>q..T.:b}..5 ...+..Y....x. t..O.......8.A*...9...x..{..i...<...z..@y....+.7.=.....4.Am..._.C...mb.s.G...{@.$..MNJq&7E:.....3]`..r.5G.u.3..".......Lu.M3.K..c.l ....)..M...Q.Kd.F.@.t..yiGX.....m$9.g..)_..i.....<.x.....M.!..4.)+.xh.....?..B..K..UW\...&.s....I.?..El..[...Id,..[.e..9.'.cL.BkE..2....?WHZ<l|..{.+{..4p..g5...N...M.......Rq....|...............Gu......W..&.IVW.oz..].9..Y0

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\Settings\settings.dat.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8431
                                                                                                                                                              Entropy (8bit):7.975372201195999
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:oRpsDDWlOdQ7R+u1N1PFhac6diLtGRZ9Q//DBLDTAwzb6+:gsWsGN+IvPLt6diL8Z2zBjN6+
                                                                                                                                                              MD5:BBE98266BFC6B702B7137FA122704155
                                                                                                                                                              SHA1:59CE491C7E209090AC41635B1486A640226241D5
                                                                                                                                                              SHA-256:16DCDB89ED7BEE07509BF7B400B0B2A4058BCFC370E1B5F23F3B67466C61EF71
                                                                                                                                                              SHA-512:6613C86448668412CF371D3476795EF6E1FAFA3E5CFA732AE985746423AAF9DF1BF255A6FBDC1A0C513495805FAC45B7A7EE00DC32152E8E8547BCCAA08BF343
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.8..t..T.n'..&..-...4..~.t.AF..+.[..../.....!.~...u....R.R .~5e\.LU.Q.."?.{.).1Tqn..x8t.O......Q..bD...l.r.z..!..o....3[...~s.eo.E..;.K.!....3\G.j.h..'O0.#....H..+.q.a.....a.X....Qzi...ak%.#...r/k...Mb....(....8>././\.#.8.P..|M;r3.Ll.}n.hZ..N.|.W#.e..\..._x.Q...{.S..T..M.....XaR./.NMSlh.4.V.T.pH.....,.@(...f...'.i...J...<..p. \.ph}..n5. ...7.&Y.@..qkC..0.YU...Y.F..=..:....D.....t...}bu.. ...(U..k..W..f(...'u].}....u0....._.....:...3.3..../F..:.4q..&..~.ZdU.[.".X7&.Z40....Z..U0wC..n.Cm.n....K.7.aN.$.K9..bm....t....2.....q...>....u...l?.Nj].F.?..Y...WC.....2....`I.j.&..h..e...E..1.|...}.+.<3.D....|c.J.Pt.p....4.`..JY.s%....5...N`.V.<.N...v.^.#zG.I.7...-....'..i.u..M...q..x|..v37.FU.O...#S..(u...R.J../cS..:^...0J..5.jeM..x.uX...*N.:..O^.....t....5..c."uf...I./*.o.Y..7#.5.N.....d.b.z..8A.~.]j.7....Q...f.F.cN.4.n.......q..z....o...;.|.-....N..K.;LC.G..MG.......|=.;..Ml-*..=.E...R_.#.D.."....#.E-.|r...=.N..wYbi...o.7......7.,;...]....R!n

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Framework.1.7_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Framework.1.7_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Framework.1.7_8wekyb3d8bbwe\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Framework.2.2_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Framework.2.2_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Framework.2.2_8wekyb3d8bbwe\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Runtime.1.7_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Runtime.1.7_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Runtime.1.7_8wekyb3d8bbwe\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Runtime.2.2_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Runtime.2.2_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Runtime.2.2_8wekyb3d8bbwe\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\Settings\settings.dat.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8431
                                                                                                                                                              Entropy (8bit):7.9793077404691255
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:Tocfj+Y+tilYiyaOF0PZYm4IIjCZofvbfbWsdT0qyBp9/4gzS+:TU3ilYiyaO6PZYm4OZofvbfbWsd2Bp9H
                                                                                                                                                              MD5:F6ED0B0DB82C7E5E8233BAE7532CC39E
                                                                                                                                                              SHA1:CC729AF39D6FFB03B3009DEE152D914D698395E7
                                                                                                                                                              SHA-256:D20AAF6C7214357781B7FD23C1DEB30FCEBEB7EC9F3A2102EEF1B83E1554F343
                                                                                                                                                              SHA-512:7C64208BC6E4EDD7173921279B07E4A9D7E7728C8A3BD5804180A5924A52DB13D42DCC592D47CF576581ADA6D90D0971412AAB72765446101A1B42DCD4007DEA
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:j.,U.y...og.-+.c<.^M..f....0Z...m.....}r(.g.mB9.....D...p.3..Q...G.i8.G'g.d.1r....gRs-..-Z{V.R............T.....O.. 4..K.[..|%.i...b..@.Q. e.?x,b:......B...,.6.ld......../..0..L..@6d...+^n....|..+S..K....9:....._idu.n..3...E..W.....V_.hhLN.vB.N.k.OJ....r>._.>D.oR).aY..d...R.e....wh.o4.....C.f&'.."8~.C......X.`l.L.8...;.)...m.f.L.d$.t.\@a9.K.'.....R.[...yD_..].X..X.c..Fc.;.......-@N.y.Kj]1+y.j..r....3./nH.....0...m..F.6....e.....#..=C..M.......K.6....W2`8.RZm.d...f...c5.G!T/...L.f..#.....*..t.uW!.C9&.K..J~.5.+1.6..h...Q...S$$...ZD|. @X.CN.x.$.......j.\.5.yn.cT.c.......5....y.Q....x..)...`....T.2.<.....{t....7.9s.n...ap..}..q.....|...0.4...m..]GI......*..q.E;....I.:.o.ZS....3......s.(.......~.......V..oc@._.....{.....&LT..8.|.x......|-A......!Y..|....N.0R.$..@...[t.....2O.Pl.R... ..:P.)..O_...R...vO...T....8.y...Nkc._iY.1N....W.YJ..t.\.^..]..+..#...S.-......:.U.qR..N!N.A.(..3.............JN.....*.-...7O....H]......-...O...5j.ZV..I..p.go.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\Settings\settings.dat.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8431
                                                                                                                                                              Entropy (8bit):7.976066394637303
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:2lBd/yNgHs3HPR09RpURwV4Cx20Yao4X28BHX0p3ldsRah+:gdY1HPRkMQQ0Yao4FHXi3URah+
                                                                                                                                                              MD5:2015CABCD6C28CB175B9B02D98DE7DD2
                                                                                                                                                              SHA1:278A57B3E3470B26AA305EBDF197205290D6AF1E
                                                                                                                                                              SHA-256:2186A1DBA388A67698DD9CC40A63AA31B59A6B32B0A620A3A3795B5B10CA4988
                                                                                                                                                              SHA-512:46B7BF4B0EA852512A606E4CCC9DBDD441A351325172F28B16A435C0F4AC68A723349D3B2EDD9B3266F3443B1BAEC8910522545CFC06C50B6C1FC62FA1B4B976
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.f..p..h.. a?y#.B7.h.y.P.7...0.......m[2.)qL..jx3*|2,...%H.a.....R..f..<U...I4..?.....w.o[..K~nW.\..-S,..5_...G...A..N..sP...X..w.~..[.l45G.......X.2.W{<.......C.|...AH....!h.UV..P......h~6.p..........1..6....;p[m....T.k.Ji6.....OyV..G......l9..d7........d.._... ..".'Q;.:..r..B....p.;.D..@..`.j...zR."R.... b.C.4......+._.h.N&}..O....D.......W..Z.}a3.j..jtp.,...i.<K8i7.$.%..z..i>.E.pR....c/.n...}....3...X]..Z....Bd...a|fL[..y...+..M.N.@|9D+:..m}S.......S.w.........T..0./^ek?....T..-.7o.L...So6..&..g4sG.{#>y.'.j..f^.....h._.`..J3...HV..Ai.....K..!.L_.y.w.x.C..R$.....}TCy....a..V..N._.S....ng..kr:..pq(.O......y.......[c&167J6n. .-..,.@U .}....;..l.....*.b..F.F... .+OYx.h..3...Z...u!G.u..........o8../:tq.:.G....dL.....\....C@.:P....3p....P^...*z..=f<......(.....c..Q9......x.....*Q..t..[w.B...7.Q...S.L-.....n$....."-...M...v.+.H....2.'..5..]J.j..m.%..k......zz....l..0$.u.O...xq.....|<.>MN...6$3...&.....l.bI..m..j..;......h..o;.3O....5...K

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\Settings\settings.dat.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8431
                                                                                                                                                              Entropy (8bit):7.979249931805278
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:cXdUkZZgFBMIhyd7yIWy7Mfxgm8R6Kf45knNRNtLGvTubOEzz+:cZZZgFBlhYZ7MfymbUNUvaaEzz+
                                                                                                                                                              MD5:FCA4D046E1F047AAEBEA9C9301CA8568
                                                                                                                                                              SHA1:8D6C49F10B26CA3372DE5433C9FE2582558172FD
                                                                                                                                                              SHA-256:6E94DA410E900FAA29A79B9069265C2B61ADEC5566BEA1AF57BA5734CED5ECBA
                                                                                                                                                              SHA-512:0B10B6917AA16E6EAACFAF412DF0289F383CCFCAC1FCA4D4D0F4B485F9B09612373A6D3789A36B8CFDDA5D947193D89711FDCD58CE72ED4059D9D50BF158DE03
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:C....%..}-p...tgT..uw)..Y.O..8...r.c.)2..71f.Y.D.v4G..M.,...U.../....%.T....1*....."$.|~R< ...nl;..=..c.o..C.[m..nh.k*..>.:..B.....7...?...-|.._.....{...."89.x.ax\5j.)x...j....JY@_.:.y..-q.Ejj......}V....~...p....mp.c.f..njd...!k.RUC.....S.}.'~..,u.&.....8.<.}..p...|..*...o. .!.R\.4.;L..y...E.P."..q.bg8Udn........C+.....!.."...r.2...}.s.W."'..s..RO .3.B/../.u[.8:.s...0..0.....x}.....c..r...._.Y...l. .s...U...._G.,....g#...7r....{.X......y...d...NZF...!.o.Yv.63c)6.8..w...W....qi....&.n......B`..9... .....P.0.0.~W...9....c.....P_...5.....0...*@....V..8.l+...l..gD..h{......$..[o.U...=.e..0....!.....vd..........-D<..MM...`Y~..UF..?......~..'-.3?.6.>g4 .`..O...b(qK.(....\..|.PC.n.'...M..X.7..?..tD\'..^Z.F/2N.2T51tVe.a....}<..o..!........1_...].Dbm>.Q\a..s...../..d....z....\..,....)...H|..'.zH9I..........$..P..^..bl&....P.~....x.IyM3.....QI|.......E.f..Fy...z......t.c..t...."..c...^2..Un.?j.r!.]..4."a.N.........H..........Vp..f..V........<.t..n...B'.4.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\Settings\settings.dat.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8431
                                                                                                                                                              Entropy (8bit):7.97493236602435
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:qU6PXMLwhnysTG5XAYv/nKfGdSG/SHdaUiPLv/6YgKU44dT+tvo7f+:qUqjgsTGlefGXEda/PD/6Y/4se7f+
                                                                                                                                                              MD5:93A16AA2C9C0E63D8E6A9C8FA3388088
                                                                                                                                                              SHA1:A4492F13F9B798699E7139A2FD3419FC88E37F94
                                                                                                                                                              SHA-256:86C847A804531C46079531C49CB8B84B3DB4B0955574F34410246C977BA627CE
                                                                                                                                                              SHA-512:216571F884DE1C6B924B6416E66EE669C1BB4168E88D3959ACC6673455B838C1573D56AFD7AC4D65FFA5923EA728A80201A3F968E6CBE5D0697937C47A3F8CF2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.eLdt$..[..@...3.!5].......W.Mz.e.G..5;`.m*...+..1....=5/VK.1?w...!H@,..fQ.N..!..5..B.......^k...8.._Q.6`[n....T..`..Z..#....v.....\......r.@.W.&i....Ns~ym.[+.i.....t.j...[...H..ac\..o.K......&Q..]"Y.......z..{.$t...'Li.!...T@.<.Y^../5.{....m.q..UYv4.?..w....{.6.B...*}-......W.r..>...sC...#........z..0.tX.W#qi..d.g.?.=.k..!...{..,....I.Q).."...RhZ...T...S@3G}*I.*((...e.2.../..F...i.p.@. .#.p..3....... C.u....+cE^......VV.Q..@|..V.70..S.e.h}M.|!.....[.....'eZ.`.kf..P'..S....%><......._.N.h.~....6..@..~..s8.R]S..K.o.x.\.!.U....$..............w!..k.}..........O.C`..\.D.5../a...3.+J.u."g..\.d....2-:`.Z...I....3.o({.r0..JIn.gO.6.E.L.R...'4...PF.q.,.SnQ{..s....!...v..i.ds1...I.f...........Y..5..#w..,...:...z.7..;..=..T.=......T..L.U+.+.e.D\Nd..v.,%..0S..(s\.:.#...;.!.M..$Yri....x.z...1C..*%.#..,q....$...A=.kc..Y.z>h%{X.d...;9.......|N..*......%.T.?._f.@..Q..!Z.IR~...W.....8lN.........8.P.7...v~9.op......@......~r.1oT...!..."R..zW....b=..3...

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.UI.Xaml.2.0_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.UI.Xaml.2.0_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.UI.Xaml.2.0_8wekyb3d8bbwe\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.VCLibs.140.00.UWPDesktop_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.VCLibs.140.00.UWPDesktop_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.VCLibs.140.00.UWPDesktop_8wekyb3d8bbwe\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.VP9VideoExtensions_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.VP9VideoExtensions_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.VP9VideoExtensions_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.VP9VideoExtensions_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.VP9VideoExtensions_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.VP9VideoExtensions_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.VP9VideoExtensions_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.VP9VideoExtensions_8wekyb3d8bbwe\Settings\settings.dat.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8431
                                                                                                                                                              Entropy (8bit):7.976995215054764
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:n4LkckKNMWUtraIVh4e/9bc9wTlksFDPJGGV6rlD8+:nkkckKeWEjhl9/dPJGGVmD8+
                                                                                                                                                              MD5:CF61ECCEBA18AE9C1A7DF6C73F26B4E0
                                                                                                                                                              SHA1:279CE1C7FE08AD64670A62F2EA4FF22C2B7EF236
                                                                                                                                                              SHA-256:261C5F92E2AC2824E9FD13FA9B92CF985511E7263D787C58B7CD8262D678A1D8
                                                                                                                                                              SHA-512:03366CB95D5C54AFB5815CA27CEC64177333DC839A31148422B3D5085D531CBD3F9A75A9A137B832FF3964F3FC6644564C71E3099DE3E9BE2D97554B57DB17D5
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:u..?,... ...&..4.<04k|..>P...yC4.h....H..:.7............Q*kI....X...T......7.q..I.i.Q....^9............WU...<n.b|.2R..10..h..M.vzzDB......0c3G..e"D.1.q..H...*...2....|.FjI.G.CMv..p..e..2.Oq..........T..Q.9...t...(....XI...I..'..W...e.,.2>%.......\.....&....8.w..........Y....To.b.r...8..q..#.[#.K!.xP..%1ITv..K.|....,..R..m$....[.I[....._......=.....dQ}.D...l.!7..l.,.S......#w.V....%x,..0...u.Aj.......p..T@....i.Ze.s...W..a|...4@.......4Da..p..._Oh...'..Zs Qr.....l.m?.~B..l.......Dv.f..tB+.T........b.....6...Z..............Rw..j`...I..CMr.y.EQ.R........,.R.3...$..ou...|..{.o.y.....(.^.4-.=r...^...~[..v.b..@DU{.g6.p.B..]..t....b.T.....t.OA.4.5.P..T.Yz......./.`.....r..j.1..Z..J..t_.....;A..;...eTA.....].........n.,.%j.E.wT.f..Ei.&.....s..P...k/....,.5.[.P(w..x...]q...Z.^.._.o..u2.....G.h.q..6.%.z...A.80.fx....6...e'......a;..?..&..e3Io..V.b.X.._.u.%....JD..S.....H.R."#..TU.<.5..DYy.L..c..~9L....j3.M.9..C.h..+).GZ.].mQ+a_.1x.fIG.i....f...HY

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.VP9VideoExtensions_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.VP9VideoExtensions_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.VP9VideoExtensions_8wekyb3d8bbwe\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Wallet_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Wallet_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Wallet_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Wallet_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Wallet_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Wallet_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Wallet_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Wallet_8wekyb3d8bbwe\Settings\settings.dat.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8431
                                                                                                                                                              Entropy (8bit):7.977963545544173
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:LUpXmk0ufiDu9hZsqUQJAA4xRtGX42039TWMJmBMinVX+:LUpXZqDehDJoxRtTB3RWMJmBFnVX+
                                                                                                                                                              MD5:459A9945A9296E2365C5C37DF5951B1C
                                                                                                                                                              SHA1:9E617471874132136B368AA2DBFFB945AC49F9AB
                                                                                                                                                              SHA-256:5824BEA1C175AFA9F62A63943E5EDB2C1D9692CE44BA2B42456CF1F1235FFDBE
                                                                                                                                                              SHA-512:CE5EC9554DF1B137F6D28C459C87C15585D3A3968000E81427656D070BDE42D01CBAC3DAA0959281119DB7AED52CA2FAFF4A15821616962F3040170AA9985A82
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:R....;M.@.F{...i...R...I^.4..K.#X$a..2:(...r..1N.O.@..D.H...(_M|.......?.4!%..m..S.%.A.A...h.j./Y5'./.A...@6^......99...+o?t...1...-..!F.C...~....wv.....QL.O..ZwBC.i:Cp.'...#......C.*..Y.......U.r..X=M.4..#.k......Z!..%Q<.Ro(@..>!H.y..+.....g9.b../.l..7.]......0]....I=Kk......|.....M.;pz.....CF7.e......0f.....'.wxh.O.R...<J....Gv..Q...`.!..KxW.....#Cg=...,.g<....&...=..<4*`...b).;..o>k.....>.:..&j..b.|.+........7.M......#nE....z1.4FU:d=...P.H...R.3..Q..:.....m..q...U.........s. .#.2.q.G'...;..L../.E...q.A.....D..o..3.j..>..6 .maH.K....DF.]Sh"H.}._.Z.6..9")..?..%.?./..UJ....[.#LObJu..g......-hA8..W%.;....^h......k+.....';..9...|O.K...J4.........n.....a1.V.UE..{...q.v....*1..i......f.....................;..D\Z.[o..7.........."E.F...MY..O}...KR........X..D...J}..#....VH..Hj.n..~....+^Z. iA..q....C@Oy..E...[........@:.....w.:..n..Y$.MD#S..b....<Y.\#..Fd..qr.kj..H.&........q...b.G.8.D.......(..5....M........n.......m.g...B@$.".'....P.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Wallet_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Wallet_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Wallet_8wekyb3d8bbwe\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.WebMediaExtensions_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.WebMediaExtensions_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.WebMediaExtensions_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.WebMediaExtensions_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.WebMediaExtensions_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.WebMediaExtensions_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.WebMediaExtensions_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.WebMediaExtensions_8wekyb3d8bbwe\Settings\settings.dat.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8431
                                                                                                                                                              Entropy (8bit):7.976078763265863
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:Gy/Rc675wtTHE1vsT9YNJvOLk6U9hnsZapkkmld6DFbFQmnjCdc+:BRc675G4KCfjhskp8n6RbFvCdc+
                                                                                                                                                              MD5:8C50D685ED964710C1B6B14DEF494CAF
                                                                                                                                                              SHA1:BD48B560255AD1A247761D3AB46B52A50D6000C8
                                                                                                                                                              SHA-256:2794279063BA2B94000559D976688C9715D7429BAE37B6B8A7F700CEAE19F023
                                                                                                                                                              SHA-512:28148EBC69BD72669959BD348AD8CCAFF3DED521EE15F6874E8F7E5D0B879323E4E4FD25FA9EEA289831D7583DF5855C473029A1B43F91C38DE5D26698A7E7C8
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..X..f.VE}J`.{'.3gfn...fL.S.hm8.G...{-.C.I..qf......k....t......t.h......g.S.v..~.]UHq.13.8v...,..E.G.e..\.....b!.k&..t.Z..s%.4p...,#(.n.^zk........^-...\...._@S...d..{_...:W:.....U...r..B..0/..x.1..yrK..?~......n...[. ..(r...)...5....).HI4#th.[3......3..n.NE..~"..z.r....9..+.*.D.Z...B..>.%.*.5....Jk...Z..HR...z...........pH......1`N.(...'..K..{....XH..|.w."Z.j...:A..$.bX...o.9yv.z.l'l..._......`.98...|L|i.|J$3..9.{...y^...qY........;..:.V{..U.]Vo....{...O.UW....Y.r...6A....,}vr... ..I.>[..$_T.. 5.d..}q...../......D..#.Q.]..v.....>.3....8=#0s.....].@k.G...0C....[..$.....l.d.bb.[u8....{...-xU.....a.+......t..........Xz.....x.K.=.D...c.. ....K..iNuyqM. ....Y.`K.v.S.u^...B..}..".;an.M;..'.HC......R.!....R6.:.|.Z..|...m.f0.9.AY...q.e.;_..]M.sy.~.>...0.~r.g..A.. T.........*i..v8Q-\h.I.....4")R.|.......(w.s.Tp.sP?...N.c.I...T......c#.=..%`}.5.#.x'L..F......U!.U;N.....vVT~..ntu.w5[....+x.w...OH.G._.]....%.>...}.....'...........^+..>..`..8k...

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.WebMediaExtensions_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.WebMediaExtensions_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.WebMediaExtensions_8wekyb3d8bbwe\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.WebpImageExtension_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.WebpImageExtension_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.WebpImageExtension_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.WebpImageExtension_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.WebpImageExtension_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.WebpImageExtension_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite-shm.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):33023
                                                                                                                                                              Entropy (8bit):7.995208715049978
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:9pJePetmZk62bj3ZnyhJpTAq1TUXfadVU2Uq8z:tQeskZ3ohLAqOf67U3z
                                                                                                                                                              MD5:F0A7F41D021358470D02D40BD475555B
                                                                                                                                                              SHA1:37571C4A6310DC7D7C197BBCA3953E9CD03D749A
                                                                                                                                                              SHA-256:54A0C6B34C57277F29948C7258EE2CDAFB5637B3177AFB347421FD650F220F2C
                                                                                                                                                              SHA-512:CA70D20B77459DBC96CB0C4D3C6F2838769C79956C178BED14C45C26A46A63ADE3C66F84C5EEB9ED22617D36790BEDCE65934A3F059726484086E5772D4BABBD
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:....k[.w.g.S...ZM8w.U.,?.....)I...!....8g"q<..j.0m..Qj.D(./9.m.Y<..,wP@?..DUn(....f.....#.UIv.8.....&..@?.|Ab.sy.q........~%.....5......'.5Qhdmf%<...........d.v..;.s.k...q.V.n1..w..7O...U..........x....?.....J..(.|q.."..Z....u"..s.\....~4`. +.f.Y87......^'-4.2.....i../...N...v.|^...b.U.......L..*V0..6Cry...%.(...].[..@ik.H.a.....n...4....8.@,...R\.H...c.t.".#0....U.L....@c`.;.m.e.n.%Ua........7.0iDl.....f...{8.....?.%.3..2P.:k..c. L..|%a}Y"..a..Y..azti.j.... 3C..c.?..Ez?.j.Q^..T...3. .B.|.S...`...[...R.........Z.|......\....z.p.....g.<._.<.MV...zQ...K.Qa....s.b..II#]eE_.q.^....w...\.N.[.......h.q..C.:..nh..........mka...4..s.7.p..1.1..7....I.l.T..Ia.....H..3..]Q5.z...q...../fd........7?..N|...W.%.x.n..tZ..4.)H.F..D...Li{..ss;!..W.......g.\.@.Y....#3.p.K..01.q.n..o.G..Q.......Jr..C.@.)n.j.X...Q.n..../....%......M.t.`..Nq.5}.J.Z6..W..E}.#.....Tf9.R..jf.l..z...>....=..4.P..Xx..5.4.K.+.{....I.._..7..,.F,a.l>...k..tw<O.[U>..\.....C.....).

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite-wal.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1351646
                                                                                                                                                              Entropy (8bit):4.377399944300273
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:mEouzmDlNezs92wBFelLmZzDjtk72MfE8Cbw5Shg/uyS8t/KI:mQyh+UHLeIjtk7z88Kc/P//
                                                                                                                                                              MD5:1335C9F413D360684BA4FB4B0C172532
                                                                                                                                                              SHA1:C256CC8B4E8376EDB34D3C662A67284745EB5741
                                                                                                                                                              SHA-256:1D269261AB9769806E139BFE690EDBB297BF754F807A3F30CE3E020DF5C9EFD6
                                                                                                                                                              SHA-512:B8059A69D812DA6359BC7868ECA380C6BC6108E811DCB5D48BFC29DFDFC56E996AEDA4311D416BE825282F152A839DA50311565BF1D8626CB0CDC449AE4FECE6
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:].A......M.m.....Z....R.Hi....w..A{...6.yf..:.D.j...^..........c!.Mi..vB...n.S...G.......5{..JG..|..(..#.w..t...^."....JK.p.M..u...8.JM.,..ca.T.r.......h/.G....I.n.....k...<U......V..(@.Y...C..yD._....... ....5.%..,d...H...............;.=n.0$.N..l.g.*G....s..2x......{o.J\:aIQ..RV.#'...#.90.T...-,.n......<...Cs.7Fv...-..i...ei.}{....:.......d..l...]&/.\R..d......f5"......#..S.P....*7.J' 9e.2....n...X.../X..oPF.;E .jWUK.....t......7.@c...iU!y.R{.....F9..W.u..<........>.T.i..0s.KA...~..*l..S..3/.[.9.4.V.J.......d/....f.....#cr..s..RAOM.y..e...2.J.(..S.......>d<....n.?..{........._........c...X....(>y.MM.<!T.0.+H=_K....%>.@=E..|*.)).`.)...v....e......#.,o.s..%.7#....x..0.v....]..x zRUyf.zf!Rbf..Z.fe..z.!.k..{....U....R..u..K0#.[..e.8..n.2. .Rt......}...9..f....L.r.'b1..'.;n~..w\a.q.W..M..w|..x.1..C.4..,.M\8...=7?....76..b. ..Ps.....+...Mi...@~......I.-C2..g. ...M......N..G...9.~VlRz06......^qq..*.g.....7#.u..a....l..oj.~......G....dY...4v..

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4345
                                                                                                                                                              Entropy (8bit):7.953484781868018
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:uFz8uR4g+IiEHDWluSdk/qfccoIflS9rY559B3o0+:YL4gPisilFdkqQ+15o0+
                                                                                                                                                              MD5:F28CC1601291C809885C8EDD8AFBB890
                                                                                                                                                              SHA1:5D933DFCE9339F357EBE2A97DD711B9C00798D91
                                                                                                                                                              SHA-256:3F4DF8CE33EAC1BE4AD662920C6CD732447874C229265051A132082BCBBAC988
                                                                                                                                                              SHA-512:459A5FFC15552D71710C620945C76EBF49264A82A2D5C564746DAFA6E9416BAB018ABA04E725D056F529036BDD86BA1D2D87FFED2AF9CD617C53006A816E4040
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:g........J....)\.m..^...x.1.}.A.......N~.h.).....U....Rg.Q..N...Y~:x.f.T..A..j+.A...K...VN.pP...z.%q..b......D`.u.L.b.....g.$4b..=.p)....l..K.W.I_/...d....'.0...V..C.3...7.gC.C...].......H....m..\$.1.(..CY.5...;..../u....l2...?..h....(!I....J].h)v.&$......l-..mB...~*...j.q*= .....r...Ukh.H.L..kK.Zwiz..W..aP..S.Au.....YS@.eL...ZoRG..r.....A. ..5.......?.N........T]o.$&..1...K....D...t..YHG..<.c....P.s^..J}6.9....M..`.G......AI.'].0o9...s.g.kL..C.P..`^R.:Rk.!.^.3h.............&;..........S....8..1..........C.s.....:o9.._.na.......7...;...P..!s...8...04..%.0..S.7..n.:..].2..en..\5X..-R..a.V.h.........41..d.-#kg.L..nD..=.3.v..s...{.p........H....xOq.%..g^A.....&....B...U..^.. .?...!L...x.:........b...OM...";r.z.L.........3:wA3x~....L.I'.^..^x..lU..~.....".-P.F.>....2...vG..D[.f.c..'<.......W..p`....._>..3^...-..-...q3..&..8......^m..\.c..$j...a.S.l..@....9.[[..4...C>5..\....6...)6i..g#..j]&......QM..9.k..P.A.P.-......#.X.;o.=..c.o#w

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppTracing_startedInBGMode.etl.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):65813
                                                                                                                                                              Entropy (8bit):7.997241918437688
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:1536:OPHn4n6X8bABL7ZoLyCyNWqeIFmwFndIlidP:OP4nq88L7WLyCywqpmwFdIlip
                                                                                                                                                              MD5:F228AE32CEC3E2343F658745E6D6257F
                                                                                                                                                              SHA1:8D0B2DE9D4630AFEDC43CCFFD3D30FD9E5AADE11
                                                                                                                                                              SHA-256:2C700419D7D4D2DE284F8233D8ED75B4ECCDB0057672CC7C3A3EF69B03FB17F2
                                                                                                                                                              SHA-512:CD3BE16E7D25EBA721DD3692243F54B90050E36B8111A66B3F23C1A869B0F9BA66BBCC7F21FEB83F19087C9FFA6DF665EDE9C773007FC619A6FCE98394C9C033
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:...=...........4Ev......'HV..y....-..;j$..N...r(.9.....].bk..`..Z.v...9Q.....@.s..W(...H..7.H.:Z.Y..D..FD....It;.,..2..k.f.0..kG.a..((..W...a.m..TC\. q........j>sz'.{}......8S.W...n.....U....fG...D....ptu.^U.T..`...........<..D.A.r......#~...0.....`...\^.=(..q...H.&..g....q...cq{".y.nv.C...Y.o.yS.......Y.^..y...i.CF...n~...u..._.|k...c.....^#...K..V...e.;.w..6.$.i............3..$$....kA.I.m.......#b8.....d..F...EZ...]..2....).K...Y..............e...0......?..[...rI}..Xl.EY.....k_..f.~..=b.u...(d....j.,.T.b...P.Z2U.9.D.0...seh.C......s9i.`...}.!%%".3.4...3b|.g.|.l...{,..W.0....p..6.x.w{Q...T...G..."..`.....d.....|!~.2z...4..... .&g.M...m.....yO...A.r.u.wi....>,.$l.vN<. .(....L..W..0..y'*...,.}.K...y...A..*...9.r..v..T...{.'e.(.B..%s.i../...gn$....../..^.....R.e.......Vug3RPL...RLkB.V<p....s...S...M..*...fOh.yR.......8.?..W...$....R....k...j.6<...G..P.ylO..{.....;h.6..R.....{e.......n.R...x....p..h._.....m..(.g.W..R..+..?.49..1.>....F&Y.$..

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\Settings\settings.dat.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8431
                                                                                                                                                              Entropy (8bit):7.980854842016431
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:zTTaCKIb1DCxBQBhrQ58il6pHmECxs6jRxMMcmRzNX2b8KU8fOIpPC+:7ahIby2Etxs6jQMrhRa8D8fOeC+
                                                                                                                                                              MD5:A28772CBC3FBB168852B9A261A6C3236
                                                                                                                                                              SHA1:86D8BBDCA617950C6E73CD785FADB286882ED4D0
                                                                                                                                                              SHA-256:F725F8E80A888316EFB4D8E33A0D13ECCB9BEB6C1037C343375FEB5EEA018385
                                                                                                                                                              SHA-512:522217F60FD4ED66B4DE4652410D0623D5D108A37E6D0698C6E5174E6D92D3AB8CA2B3F5E454AA72C11093EE6F5E86D417A18A81FAA89B492467CD03113F94EE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:s....j=........fj..._..f.....|..kK.L..*.Hp...X$...R-Q..s.....R.e.G[....Ba..............H.,...p<6|>=......F..p..!.o..U.q.u.G....|...0.l..O.PYV..=...)nm....@....=...wOa>.CJK......;.z.|.<zh......3..M....h....U..Mt...x..~....}d9.iF.6..p..7.fEo........o>.e.h.4.I...u%..._TDh.........#...n.q;.zh...t+..%[5.V^.&.K....,FT.."..?..B6p.P.\3.|.MGi.3*c..Gb_vc.Y.n.+I.<U'..aN.8.....x.=.^....HV./.......u..q......;....V$$H.H...RC....k..e...|8`k.118..}..dx..6.?......6.W........<.l&..5..>...uY_.$........d.zg...r `.Y..i.....,v...F...?......U..............$A:..X.....u.....Y. .#.M...8..:.#../. $..;.._.H.Mo.@.f...8....7m..^.zz......*.._..8..;(N.7.}...*:r...'C....|.1Q.Zd-(Fb.m.....15.Q.i#....4{D..Vm.....2Y..qF9.["$>.... 2..,..{..q..Y6..MJ......:c...h..6.$~0.ET;....h......$1"....D.-.b......cu+..;..../..eV.V...}.?..6.W\...R..=.._..].\....L.E.,k&.P._..O.2>..'..... g.\..0:.h..... F.S.`.?rZt]...Q..R..r...S....T....T!.`...DX.....q.\.F....E..C.........re!..p8E..5.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AC\Temp\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\LocalCache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\LocalState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\RoamingState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\Settings\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\Settings\settings.dat.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8431
                                                                                                                                                              Entropy (8bit):7.981704027011972
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:Mp6T81jq289aEogq/aDF5pEXiGLYAXkZ3L2xJlK2x16jLe+:EqXRACDdEz8t2fxYjLe+
                                                                                                                                                              MD5:04E3280D1109601EB28268BD36CEABA9
                                                                                                                                                              SHA1:C154FF5A4D656B3B773DF6DC2AE10BDB2809BF75
                                                                                                                                                              SHA-256:B34894A5932AC31935BD44EDC68CA3CD4DE32DA0E1219C1EB8985C8BEA985E69
                                                                                                                                                              SHA-512:86BBC79096DCDB400FA7F8C27FB0919A3F9DEFA23D1624C1F9035516A24E3BA85DAED5A47DF2C7F24AD8D9037B08B01E83E689CDEF5EA5AF4D8EEBD77498E40C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:"......aC.W..h.P......N.....\.DE.K?...zO...{k.B...z..3l..]...,....U.L......@..I.!.o.a..'m..bB.....9....~a.1i.u9....w. ..`..*o_..lzae...)Klt.b.@`C....y......H.aFT.eT....X./.Fj_2.`:.G..F.....).+.AL.\.}(h.Go........#...{..L...:K.^.+M.n..v.)I.gK.....J.:u._;..Y....P.!._..../..N.......m......$...V.N..V%......D..d.a`.....k9O...K.P1...J....BD....VE..Co....jN.T..E...s&.e.7....1....c..........|...!.....gV_.A..,....M.szk..k.P.#7).....R.."...F.cU.....\&}..o.....[........f.3..Kj......LyB6..p..`.........A.|.?d.8F..*.....tj..&pc..h..../........F|....ok.}..u+.....Z..i.L.u.'.bI......1G...6.:QRQ...[...]..?B-..1!q..2#.;..VL7;r...8.OU...,_..+R.=....8.......-H....G.a.Y>.IR.Z..3...0....U0..M.2]n.&H`A...ekC..+..y.93z.u6l..1.;.."j.H.%..b.Z.z%9.....\...:U,..E.%....8/ #}.Z.~..o.C...G.%9..\...NHD...mk....Z.....l......].W..$0...x....^mc..K/.B.j+.t\L.&.....[D..=.'r..e...0.C..p0......N.Vr4T.`..\....).p.;/.sPG.`>H....G..._9.E)..\.HFk.^.j.....VrG......

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\SystemAppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\TempState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Temp\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1573111
                                                                                                                                                              Entropy (8bit):3.599582701106012
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:6iVQM9/abjTBUbbH5IuLPgSoi0AioxSbS7f1PPK:6aQSabjTQLzg80AixbCfJPK
                                                                                                                                                              MD5:0AFCD3BBB842A184F77C5B8E1294272B
                                                                                                                                                              SHA1:4A5577B617B58BB6C541B665A397CF8B0F94C78E
                                                                                                                                                              SHA-256:ADA3A90D521DE1E3FD542237AF0D69CCFB380DDAB05BD9849C71E5C818552372
                                                                                                                                                              SHA-512:8BBA4A6874F27808BC34C69FF501F6F16D14EF132C8CA3AAE3BB780F3735260008F48DBAC589A62B76C4692D90286DE83F47DEEEF14BF192A2D08831B9541C9C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..@d.......Y.(:V..N8mq.....rKs.sTV.........o..OI..l*OkrIO>...E]W'.}.X....<"u.'4...[...S......2.rn...-j..N...L.I,..s\.{f..X.....&.Am..1W/.md..B.=.HT...x.M...2.G....'f..rjr..m..cl.:+.._w.hgZOT2O.X..!s..>.ve.....].......}.)..........14[....*du4D..ev!O..\}......L.!.F...W<.}..T.j..(<l......A`.f..a. z..c..7p..m../..zA..dG"RJ.,......\S~33u.e..G....l.."........t.&....L.....z8X...6.i.*..F..&...V._fb..W. ..;...CSe...Uh....i.kr......q.T%o.C...?#....Ny..._J.8..-.>.....6./..w.=<j..]h.tK..-he.D..q.....D/UX.w.,./!..>..../.K.h..:...WIVtM.[.!.2..m]....M...py.B.....#.L.&L.k].mO7.:Y..]].<F:..;.e....*.W-%R..J./;....P.>yi.=...bX........H.....)SOv.X.|(.N...2.<.X..a..<.yh~.T.._.....%U...~O.^&)..6...n-"V9Fy.||.....e.y.\b.[j..Pb............Gd.0|=<.<.pB..#.P.I...:Ej.|..R....`.$ctQ...b@@s..~......H.8T.....z.(..yE..1c?........b.q.0..*...=q.\.....?`>.m...gt.r....7...E6T:.8^]0&.S..)kc.....mt.Z(T...b..../...(lF_..C.)3).Zs>...He..s.'nX~.8.h...E../s..YRD.R..6.1.hwI.n..c.B..3..

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16632
                                                                                                                                                              Entropy (8bit):7.989262481648317
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:WUVEv7r7qkYxL7rkLFxNbzy1wsWVQbObwF1TvB+:xEvmkYxDkLPNtiibu6
                                                                                                                                                              MD5:4CAF085ED049E3CC6EF8D7E60CB00847
                                                                                                                                                              SHA1:39CFDA0E67F0021EF5A63F4081BA5E4024E9B3C8
                                                                                                                                                              SHA-256:F009D1EB1E8979AECC3D83A482C5BA0CD6E62B78E822F0227C1C1A05897247A1
                                                                                                                                                              SHA-512:85130EE95756398BBD9D142B254BDBB34D905859FE6A2E77019065169BCE6A510CB72D8799DECB5D34EDA6ACD561F0FDD9820AE479C6B1543A5E6FBFB68F5AC1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:R;....D...u.s.!.......ntlO.%&..z..90q.....\.&&.3U....j.]...k.+..TK.Hh.o...f^..v5....%.F...+....+..y...m..a.....,f..HA...*+.<=...gNi@..:.0./d.......M.^..P.^>d......\u..>..Q..z:..6...P.i..B...Lz3......~.I2...[..hw.....i .?..7...Z....Iw?.!.].......I...n..k]n...D.....C...)T.........)..GO..R../..BCN.-U....OM..Dm.L.S(..0.Pw.4......)'..&..2....N..M.v..'..LE.........B...r...oK.8.FG..>.)7k#!n..O.......tnj>...e:..2...:wG..W...c.9...(.{.No......A..._=.xn.$.....0.C}.{X...M^....i`.D...).....i.A?....eL....A.^@]..*....*....#l....a6.}H&&.VA.....=..1.:.6..*..m(~0.w.Zm..,....B.Z.q.B.Jx.f...".$n..L...2c.a:R........../....@9........c.v}U..:...v.....P.d.X.h.="...MP._c..W....L.{.#..-r@......9:T5..........:..ff.0.....P........w.JX6..NGr.Q.ac....*p...u6tX..S*..?.pn.&|.\"G.3"R....c.^....u..ds...f.x.G.C.=Mb....M...:>.+.Ie..y.PX......>d....v.Z..S%..y..F ..9H...V.....B-.cq/...(...n..dh...,..&j...q.[*...f...=...P<.6w.0f.u..!..j.d&.......c.I|z.YM....V -=.JE?..P^v..@.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.edb.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2097392
                                                                                                                                                              Entropy (8bit):2.878361717689651
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:uHeBzx2cXWDDrFKdDznBpFhyJY9dN1RFtHFiKTDgNE:JzxdWDDJ+nBpFjT1GKTUNE
                                                                                                                                                              MD5:B9BF5DF08C6AE9C4F3F341276A7C668E
                                                                                                                                                              SHA1:DD56F2714C0ECDAE379F9F0F4541EB5EC775D206
                                                                                                                                                              SHA-256:C00E8D2F8802C653E9ADB89E0F23330B1CB172BFF1848137D5E687F2C428A45C
                                                                                                                                                              SHA-512:64D5E133599358ED4EF08E39C01A767593A300A6610627E4CB923FF66005C1DD74E9779CCB9FEB3A7A21121F52C30D4FEA84167213532DBEEB8FFF82AD835A04
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:*..w.f.....S...B..@.=....Q...i..9.S'./uO...4......C..=H.V......K..I>)G9mo.{....f...Xg.....:E..=9.=...0...G/.......i..AZ..2.X<....<.U8....8.../E......%[."....u...&...x2_.Sl....).N..WC..a....JLo.9.;J..Q&S.Cr.^]...U3.("d7.<8l...)_.........x...si...ik.......<.b.5.....o..x...4|..hk}.P'c(.2..$(.....^.~..F.tU......].@a`....[.".f#1.+.....J....E.d..2.a.z^>.}.7...XkH..Z.U)^.?.#......5!..T!.?-n.V..v...h..I...m}OUy...0..S....O...q1.....+.S...W...q........z.$........:...J..Vk....m..?;6.....,H.y.@..$.J.5..l.ws.=.2.9+%.Sb73.`Ax...i[J.8)..K..&.....Z{.../..b0ZBb..;....7..B=.(CrN..O.7SWc.0<T...K.s9.DQ..2j....l...8./LV...P_.`'..{..v....n..%..%F.....[.......7..U..M..:...j.....z# 5......s7...O..1.f.q..$.R7A@...@R.Q.8....z1.B..5.v..f<QIS..f5?..O.%.lm.g].. .eyk./.'|h.Y..b.....}[:.L..8r.EC.mqO....ULLz1/.^.2/X........3c<~E.+..C.!..:Z..h..........#u......+#..........".1..h....~0.>...&..S.tm*.(...f...bN.d..v....^.|q.3B..B.:..X.3>^..W.....5..`..-..oT.mA..z....T...\L..JZ...

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.jfm.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16627
                                                                                                                                                              Entropy (8bit):7.988480978585722
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:ErtbZbR0UnWDwMUkCeAVt9DawpGP+bpgui+:YbZbqs6TktPF
                                                                                                                                                              MD5:BD5C559B0CD3C408FB990E4F2A6E0B0F
                                                                                                                                                              SHA1:5C630DC7269BA177129FC7517DF82964956660D9
                                                                                                                                                              SHA-256:E9155F2FA80DAD98CA2B2814968A5A0CFA74E58CA18E3CCAB1176B588E289FAB
                                                                                                                                                              SHA-512:01B25FA04DA951ACCAA08C470D91DC4B81351296FD78C7CAE42ABFA00B5B62FF81DA9F99C4DC0E6CBC7C4DD1AD6B2E665E8E413E65C06CD4DB8C2207B4E636D7
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:-.cZ.!*... .4y..\.]._......._.m9..M..j...#V.l...h=.fF,..I!.~.S..........B.).]........8.NG.3%V.K..K.Ln.X....:.;.G...s.....@a|.U..]..y.^,....J7...j.5T.].....2..vdB....2V......Q~..=...5 Y)..i..>.5.!.z..y.....S.P..w...-..OE..qv...qI'|;.._..#...]......E...........@..o..}^L..'.C...M..=.b.&v....>|.Btb..IJ....?$1.DL%.Z..E[.H..:.xA.{.../.E........J..f..v~M{.f.o. .DA.P~........v.../.A.....)....@kJ.Gd.c...Me@..'..4..*"...H.Z...s.".if.B.v..^.....&..@.H.....cY.....l..92.....g....0...GBh..(.B.y*.;..rx...D+9.r.].....?i..b....J......Oi/[.i.. M.OCqW..........`C...Z.......e....pI. .P..!....KI.(.m...0..Q... ....a`&..Z\......rGJ.!-.._.Y...=.D.|...(a...Mo.......C.1[....*.......g.%.7.C.i..]......V.2.i..F.........@......t:{..H..........B.;.fQy....y.v&.^.D......4t.......j...5.e...wgo>*....3.p.....b@.2........t.Pe..U.#..Mm.Q....1......'.(M...S....z..5.(....p.'C.Ts?\W..Nh.8ib.....N..J...J..a.....x.5.`ta.&.(....p';..r.8QZJ...W.n......N....'SDL5:.l....n.k5..

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.chk.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8425
                                                                                                                                                              Entropy (8bit):7.976152951148536
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:a2t8+/NNrL6gywHBzOvWx7KHlpS53r5PXosHCgMQna6Whhh82W+:a2t8eNB6FPY7KuBY+bs6Z+
                                                                                                                                                              MD5:FBB82534D8D196266C3477917E1C40C2
                                                                                                                                                              SHA1:11E7152CF7CE4C82193927BE8E42E990E4BE98E4
                                                                                                                                                              SHA-256:ED09A4594F75CB06C779DBDC25E88448DCBAEDB7094F51D814615EA6905B50C6
                                                                                                                                                              SHA-512:999398A9FA4B35238E5471B161DA4D542BA211CAE9CD2B497689F59CB4246CD9FC8C1F023E1D1F277D788D461C6E06F59A73F86E058C1905369EA45C7A011DD4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:H...$..-..l...wy..j.M...Fq.}..f_..1o...7g..z.P...\...G.+.(.......)Lc.IC$}.".V......~.iP.2Oh..;.zr...l2.<2~.X.V.....U...23..UHyh..P....s..../..B.R.]*.....*...y...W...\N..$....|..F....#.R...r.]...%q...Q.R2.q..sFzWL..h.6+(./B.z}_.OMO......HOAY_...<..g.fX.....C....We.\'...;..01.o.57..B..Ca..c^...{.}...............2....^.4...5..*.a..b....i.#....d\.:....8.7~....oh.T.|.......4^...e.Y..U.Pgp.."...."..I.Nf.y..U.h/D.R..B.....s..l..0b....(.h.4.h..9..7A9...J.5Z$.'.3J.O.^>+..Z.4.N{C....R]C).!........Z...hV.....c.....e..&......r..*L.r.....0..o.....C3...L..i...W.>i...7...;......E..,._...1?..i...`.;v....x......(A.B.j3U./.R... ...#..~@5..*p........%..."^F.f...n..\].r....5.,...S.b.4.[.LD.....k..Kc......d7.Z...Y...B+s...f.t......3YM.]R>K.7.&.E-....Y..p..J...D......^U.6...=.h+.@3......%-..n.f.n...}.x._.....\...a..z...:...............c...e..'DO.....Fi.uE..8..(.o.$}...@j...{~SW...f./...4...7a.b.......+.kC..]...p.....D.A.....F...H?.1.ZD {WB.u.......f.m.U|

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.log.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):524521
                                                                                                                                                              Entropy (8bit):7.999624042463491
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:12288:Q4Jw4QSukZlhhjOCMj9YSR7vLySY4G/imC9oJpY:S4QSu0hyCwYSlyShG/k9oJpY
                                                                                                                                                              MD5:F0AAEF866CD4A7FE74C062B72E53516D
                                                                                                                                                              SHA1:16162D81C9554AB96CCD9317F20CC6CFE301C7AE
                                                                                                                                                              SHA-256:FE673AF51F026B1209B2A73E35C215BFC08071DE45048A3F09B34A842AFC90A6
                                                                                                                                                              SHA-512:208C851DF28D94A1E453D84B061CAE6D3BAB09041728F06FFAA373524D2B7BC546A4F9047EDDEFF45B55B78549CC7BD2B36E56C263B1764F273C3D715A888B76
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:5..s.>v. j...l.../Y..=z........_.`...`...G.qv.l.........upk........s`......_I...w.>.u..Z...........7(...m..:"1.....D....8..R..[..Sk.X.C..x4.~Go..+X...4....W@..M./M.R.X.D`.{..p..V9.N.We..Ag,./..S8'.w..|.W.[.]..gus.OE.U... I.6...z.-..&m..RE.|.X.J0......v......S.N.....X.......z_......8.h...Z....<.[.x.}......9.i`...L...*..R.x(R.h7...I..s.9.t.....R......~...LoG..o.5.Vr.m|....Vz..).w*...z9....up.k.....Z...e..*N..9..t..)....Cu...T~..O.y......3..?....6.a<..-..#.......9....I..@o..=?Bt...lX:..L.K.....w.O......j..EAH.X.....Lw..J.=u7N.......;Z.+2..X/.[a`3..Q.gT..bn...........yzh..%..H.u..z.....t4.iKJ.7H?.\....=.....J...d.....B..........;.........1....[.u"?...`...nA.....og..g..z.L......,....1....o.W.!.:....L..P.}B.....(e..G.lsH(..#..~.]|l....(h....(=...x.Wl.+...J.p.e.R.5..W...aP.S.X)A.....s..w.{...M.._.e...\.L...i6.-....FCa~....ZM+2.*.R.......'.>mE.tR.......6.S...s.....X<............=. .a"O.U._..~?,.....#..Q4[....r.zr.,..t....!!...>..*..R*

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb00001.log.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):524526
                                                                                                                                                              Entropy (8bit):7.99957823513449
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:12288:fE9MyfTYOfQLIzHOMEDaLh9JpH/DXWY3ojuF15Wpr0Ii9:ctbYOfQszHOMEDu/tzWY3TFKG/9
                                                                                                                                                              MD5:D131E3D6DA8BBFFA85B35A2C9A2DBCA6
                                                                                                                                                              SHA1:7D1DED5ADC3473A1A4BCD54D6A05F1CC9D7985B9
                                                                                                                                                              SHA-256:EE515B884CBF519F00D7AE31288E64468B909F7FB510A5F70CBDCB3BD4A4E9E7
                                                                                                                                                              SHA-512:5A9EF1450E66B92F6DE8E8CBEE40DE6DCB8CABE3F74DB0970011CD1739A310AF54A7992CF8475A7D33D3F60B448EED67F033B78B909201285B1831EB1FD918E2
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.lZ...(..A.J.Rfdt.-..b....Y.t07(c:.=..$?...C.....+.{.~..........0.......`.+%.iM.S.....!N...6.P..^L74....x...$......5)..+Y..g......}....<3d.D,./.3....."?Z3..4\.>..G.M._..@....cR<....j..4l9.!..m..Y./....J:3.:1...^s!.....6.S8.@....UsC..b?../k... ......K.........GO.....OW.AEN.N&....*{w...~.....;...@..#.WH.`.L3.....j.E.....k'.g2`..d...~..2.\..B.z........B.:"SL...j.4<...j...Z.Pg...N.O..%..............7..%....6..e...8..|....r..@...!.m..3(2.7[#..*%.)c..6N.]..m....x*.$0e. ..I..s4n.v..ow.?...!.?:"....=.m/....&.@.......*_.f..Y.nU%...d.Of.%.;v.....t.......[.".Z.....~....;{wO...N..GA...;......&%.{.....^L........+.7.`.@..T.Wg@..).h..=.!O..uU..2....Yc......}...N...^.....Y.I>'.*.R.%.![F./.h..~....s.....a=......qFU..S*%].V4a.!....E. ^..q/.tP...I.%....Q..a......q.....ZVc'..BW..ocz#..4..[~..<j._.d?.....R+ ..X...B......8y..s...g./7.)q.......e=...........w-..Ny....uR8...,)...i...9.........PC...cq.,.k.....C1.7bwL3.ua..-...*.....Wka.u.L..h........E

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00001.jrs.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):524529
                                                                                                                                                              Entropy (8bit):7.999707289369819
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:12288:mGXgoFgiLvE+IdNmniyVO7lcRd2bZeC4awL63oTI3yeiQG:mkWiKwiycmr2bZeC4VQG
                                                                                                                                                              MD5:EB919CE3D0EB90A6515FC29F3581BA88
                                                                                                                                                              SHA1:4C907350FDA61CC8DCA85947AB0789BB80A34303
                                                                                                                                                              SHA-256:7E5B20CCFC6448EAAB90B7E6E731A853F7F2E9B5DA7E81F42323D968D75BDE50
                                                                                                                                                              SHA-512:EA9C2E32E3DA27C8D48D1523741EADA6A0A2CE8FAB1659C08F0531F3974D14EB28EBC6F048083415FC38437AEC55D76EA3B1FF2BC5875369170F7852CF342B9C
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.R.Y$. .o.._._R.9&...F........0..z..)K..B....!.....v.DD....J.?..m..EB.....8./.O....(......f$p...Tc.`.-..C..F.@.L......3>..hy...w\._......F4...g..V..+g=f..[u.-..U.q^.L.9..p.......S..pMJ...Y.n.!."g.a.....Y#.......A.k..%M]V5!$..GID.^%....A.Zz.....{....x...y..O.N...6.L#....]..jK.:.`...G.#K....;eC....D.ucj.D.mu#Z.GK3.m.q.Z.....+....Y...&.....Ph$..m.V-..N^....O.)*..h....w............UUGx..#.....\..Q..7&..c...pr....]t}.M..l-g...h.:.I....\..O...7..,.t.....*....v..Y.."L-....&..k.P....h.....C..&[....Ws(..vn..A....e..q...].D..#>D ..K-.q.C.e.g.........&4....i...I%..i......-3&j\.Q.y..}......%..L\.W..Q..O..g..C.[..|..<...7.h.....H.1...W.5..,C'..9.0.z.^R.q+(aBK]....."C/...o.{.......8uv6}....PpR]..Sf.s.\..g......u.....5v...j;d.K..5uB....?..:d..U8...q^.g'.n........_...%^./..jf..k.P...:..5..V..%...~...c."LHB...?..N.....iY.X.~.n>Z+.=,......N...a~1..l....3..*...H.c/8P......oG.:.$.T_.5.j...O.yx&..5.G?l.5.k0..m.+_.>.9.Zt....*w..>...?9."....s6B.............l

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00002.jrs.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:OpenPGP Public Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):524529
                                                                                                                                                              Entropy (8bit):7.999631414346323
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:12288:5+yyjO30V4qZtGB3Y+99Rx3KFz+wvQZsOF7hXvMJP6S43sR/7:5nUW0BfCYy9vaQ6QZsOF7F0JZ97
                                                                                                                                                              MD5:C04A274DFDCD1C33F8CFE38BFA2426A6
                                                                                                                                                              SHA1:8809F13AFAA1EC681A77D75ECF0A92283B44C6D9
                                                                                                                                                              SHA-256:2BC08786F4DC0F05969EAD3E74FA77457F6DD01123C1A528E322DE40A7D50DC3
                                                                                                                                                              SHA-512:B8BA11BE9440865AD6604A9BD4C6B0F8EEE33BAAE383852D4FA6E8BF19FA183ACDBBF86C4C8328654F82EED4FB56BB4C3BE877E08A08DA056930AB849503833E
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.'>..>.,.IS.....^.[.9....a........,.u,`.h....O...N.:......*......0a...u*...)p.7./....BK.n..V.".|.|.'R.d]o...fJ..[.9..5:...J.?.....cM.;.9......w.+o.3.W....V...SC..&.)~....J..../.+..m.x.........r,.Sp$O.a.N.....?....C.............T$^E..5.!hRi..E^.V{...@...`...w...<.a.2....a.]'...M.%u!..Z.LeI B...m.N}.hn......}..ZV..2.T,.29..U.....G._.;.`./.LN..R'...........(...SU..RM..)..B........%....d.izwIPt.z.:..:F|'gTK..%..U..d...;.....d..7.$.m..S.h..&7.r.t..<..:>r..".t|c..........i.e...+....M3.../...x..?.e...w(.A6=?....$..j..W>"~...D..@U.).!......C.....|..0M..y....."&$.>....]u3.S..c..k.u.F.!0x...@u..?.9nI.D.A..&=*T.U.[...S.hd..l..fOi`...2..R.Vc@.....f..c..hL.,.Hb..E...;..W-.....d........hj..>...d".)..M..V$.Z,..G.....a...3"bV\....E_Vd......D.......LK...~.}..../.unz5......5..&V....5._..rD.v..`.......f.F.H....^.C...mC.,.....OIZ/...KC.........s...i.*7&...b.X...{...fn. <.a..fL.........3.c..>..t...<.q....E@p#...w.1...>.j....r........@..a....6.....(....."

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbtmp.log.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):524527
                                                                                                                                                              Entropy (8bit):7.999652999107352
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:12288:Z/BU6bUFUalCVzolwH5MQUyIRSHakZgXv1jkEcg3i2FM:Z/2qWYzolwZxU1SbFEcwzM
                                                                                                                                                              MD5:F45A203EEA7790C667A1FA515F999EF8
                                                                                                                                                              SHA1:FA053FFDD33B406C7B6B59C2620A3C92E87C68CE
                                                                                                                                                              SHA-256:8CE22D7DCB0AA8EF4D4BA7B16AF0E28D80D3E0042C398451E96F97A1548FCCF5
                                                                                                                                                              SHA-512:49BF5728038BDE5B48C491003C1B412E7C0F942BCFC6ECEE747462F197B7D5471A294D42A97221F28851F3E115043AB79BC9CFC6F4BE66B30C4303D671149287
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:b..[:n}!y..U%>.l.!....U..$..o...kr.x.o?...3.7.Z.....)...g..x..?....@C -.......v.#....e.)..*z.!l.....<n.V.jM<-.k/..:y..../..sd..RM...".h....|...8...>y..d0..rKd...2....F.t.D.t.O."y..m'.4./.*.c.~..p3.I..wa.........T.......3.f.8@8."..Xyl^.....n..T.n!....,.dR86w..,.6r..R..(F+...a.&;.aY...<.n.Y.`Q.........H...j.~..h..q....:.. .....L.. lw....C.1F.h..#.c6S..A=..ER.......Nbz...?.W.....}*.<....E.|.9m~....'..s/.h..i......G.<6$..r...kX.c.MH...................$4.{p..P..R..j....#q...&.[L...3.....e;.L.1.2...<gOa.E.....Y.y;.......7.r..in/.J.X..+....B.,9.Ss.,.....J;......z.d....T.YS..!0....AD...p..|.....I}.F.o../.\h....'.....w./..1m... ..e./?Y.......&......23V_.OV.~Q.G9.'.........p.<m..*.3j.A.R^B.MU..)&.{.v.u....&....8.UzV6.3..".2.|.S...u.V.:.r...}IH..).l....)S......>.R..M.)....|.....M....\g;.8...u....K=...G.=6...#.e. ...g......vh?...p.Fd].qO......:1!.........&^.GW....d.b..GXe.zB.c&.t_.p*HK5~.....g.....`.L.....m$..6<..Jz..5%..../#..SO..&9........r.W42

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalCache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\308046B0AF4A39CB.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37258
                                                                                                                                                              Entropy (8bit):7.994371780534108
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:Z37hFKQ/+dVGhSzCvYTVhn52HLJVoUXY1mmmw+tsUTUKTVs:ZVMQkqCCv6hnqgxkvtHUSVs
                                                                                                                                                              MD5:4E235A679795F3BB3A4D56303C9515E9
                                                                                                                                                              SHA1:FEBC93D46A9BACCBF583490CBFEF51DE203697EF
                                                                                                                                                              SHA-256:EFC19D205CC70CEC187EBB4D402FEC34F822F6046B9CC97BD4FD23A12A204A4C
                                                                                                                                                              SHA-512:870408AD56E0FBFB48F715492E31A8AA8CA30D72895383E4454F9605D1C6BF337597797EAFACFA48DA4AAB81773CE79429495E8D937A090B0654522117BD87D2
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..##e.}f.1_....5.....i..."..2%&.]..-G.DyJ....C..k..}..2Wz`...0QSXn......P...wIE.B....H .h.a...X..HPI..m.s....nNe....D\ ..6!KG....h.Qfw....YXI..=....'.....5..{v`.9X.f....`.mjp..$..D...Mnc...xt.>..B.8.{...#H..i.B..@.#.WuC...%;........,.I+...4..tg(.}...#...W.7].a.65s!.J#u+..-...'.100....P,UH]...x./.P`g.wO..r.L@..1..k.K..R %.*%B+CD.J.Z8g.7.H..5.f.bu.....L9M0.'.c..?&KeK.N(....b*.#`..H...!W..2A.fW].4..l...[.A..C....>..(..{.d... .V......a...9H.IA......I.........,.,.C.r.,...bX.....ci,.R..".n.....0.+w.o.3iE{.O.bT-.<.Y..<.....^#..PB...y.Q...p....s....oh.....?Q+@.....N.?.{$......a..|.....(..oA<)U%.....#....H.vT...%.iR...V.......\I.q.-.W.U.'.2Y.!...b.;.>..g...)...-......K...>7T....v E5.BA....H.|.c..0.x..[..r....&r.Z...Jp.9$.$...).....+.x..'[..T..bm+..`.d.cdJ.i..a.1&.H!i.].Tj....].......L.:..,.d(..2..c...|=Q....Jz.S.?QA......Y^._N#..Z..,Y....>Q.. S.M8.1../.+.-.:..(..\.D.s..Gmz.....CG|..8qol;mSGsn..;..c3jH.Z..$22o...W./rS...0O-.$2\B."r

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\308046B0AF4A39CB;PrivateBrowsingAUMID.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37294
                                                                                                                                                              Entropy (8bit):7.995087384690129
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:zAdowftmIqu8VwTvxAly8/jyvyKhcZJRTq2KHbKUmlVIDYedP:nwfPqZwTvxuD7+6tqmlVI9t
                                                                                                                                                              MD5:C6767565D2375B2EF2671ECD4DF2D900
                                                                                                                                                              SHA1:6F050FE71B66151AE21D15D1F674336E2AA6D19A
                                                                                                                                                              SHA-256:B01C62B1E97446CB34501CA6223694FABD0C806F065FF0129DC301CD83432859
                                                                                                                                                              SHA-512:7E0FE922A3E4645B7C1A5E215EE25CA4837DC339830C2C14AB55B16F41A2EB870F5D53D81410E1F39B0F2937B7FFD51855CE4014789FD695E130C404C8CAD7F0
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..2.SzGt...r..\.....b...Np.~.P ...n...v.9>.`."W.T..K=..M.g....d.n.Q....R.....0`~i.....!...'......sN2q..<.&...R....fCo)<!k}...].R...|..Y...~.`c.H.#.:VH.-.....G..-b..z..l.+..T..<.. s^%..O4..6;...B....T...Jw|..........&....h....`R....42B..t!...\.c.......:1.u.5....z@.A|.q.Q.....j`.Hr.o........."...-..c;vmK..N...d,Zr.2H.X@..DZ.....h.f.D....@...5..c.U.x.F.!..F..#....s...I3....f..t.%..P6.A...m.cR.....<..[.8....<..Q...n...3....)....-.Kn9.h.!....gk......q.<.....'`..tt^.gi2.i...!...k".......=F.Y0..'.P........a.K}!.A..6.d1..~;...a.1..A..].r=m...T..9b6.C......M.....<mk...s."T......!MK..J.L.S.....,...*.._....,e.!.B2.?l9.N)..^....i..SZN..i.y.h}.}.E..0......?...?...P../..x..9..=P_.%.A....m....L5g...C.....;z.~.z..7...x(G...5.....oy.M?B.......b..<.)...(T;..G.xC.B.g.....]..)k.bt.-!.9...Hc.5..MI..(..]..J<.u.#...1.,.3R.n...+....p..5..,.:.....XmJ.4M..^..jT....cD...?.v;.#XG.u.t...>I..>........{Ws.W.......7T0...jV.Z...3*)gR...b.. ....*:..........O

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Chrome.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37245
                                                                                                                                                              Entropy (8bit):7.995501866668279
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:0EylJle0myxeuLgDewa6Wl+7iCFiW4tFAnXNv009cczcPWT0/WQSlkawKM:nMJ8zyxe3iP6WlSi8QFIxV9cczeWTmWm
                                                                                                                                                              MD5:0729C2DFF7E4E9F04EAA1803DDA3FE7A
                                                                                                                                                              SHA1:A4F641C839F35BEE6E3BAFDD81BDAB2CDC4467BB
                                                                                                                                                              SHA-256:952897E0349C1D3D2AC82D4F5B092AAFCA6DA3A1CF4490EA1DE46AE497D44D4B
                                                                                                                                                              SHA-512:11F57B1B72A0D461C8E38B0803D4491ABD5EDE775D85D486707A0551000D57F8A707D49BAB470DD5DBE119C7965A9ED667A0989B409DB78BD5EFAFB8E7AE3683
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:,+.oOn.....S.=.8._y"G.....{.a5p..h;.hB..0.R.2.96..d9...=...].%.F...F.1..f..]=..W..H.U..v.Q4...c.& .q.l(6..8..'..!......y..bqm?.4..JP"d@Zv._..V..M..:K.*..D ..K._RME<..|....[..5.*.vz[...."..z...0.@3.r.W....S.f.&.\..kJ3v.e"-..b.5..o..+.2...|..B.....]..3.T/.2...(..X.Q...j...!.n.X...X.l..>....|..rV...F.b.%.;S/T.......H......F.n<...L.N.@.....+e.vL`.....e.u...[ 3.Ai.k.[....-Y..~s..ai......=.g&..2.p..C.pZ.u..Z\e;.Z!Vs/F'....'..B..!.>r$.%.Xy...].5.......#..^...,...1..g.*/..4xw....-..ac.q.M..x..QZN.....N2......}8#s...^.....N.8....Fo?T}X...M.........AC...'......G.eT....,...-.(..2.?...M.9 . X.*.....z..]:y.......i..{...w...R....`......h..../TR;...i......w=.....o.....b.....y....j.7(..A......`..j.:7...F\.S...z.r...]:..4A.P'.^.:...S=@..7>.W...u1...*.#%W....."S1&.o......K|.u..CPJ.%.9...u.z*U...8t..ZA....(b.Qz...L... .lZ0..B...Y."\4Vg...?.^.W....#.!.Ey...9..K.o..M.d.....O....25P.4.).^..{-3..4.......M~^k......5.c....TIOL...U...u.T.....?S.&...H

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Chrome__crx_aghbiahbpaeidepookljebhfak.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37287
                                                                                                                                                              Entropy (8bit):7.995124661252187
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:HRulgF2gAz/hN/MH4HHLeK+cwlvYFXo/bHLa4jTmPgWz8R:x7Az/hjnLeP9lv3HVj6uR
                                                                                                                                                              MD5:72F49243412FA00D1D31E8C01FA3AF08
                                                                                                                                                              SHA1:B0D3809FAEB9E67D44CC21C70902CFC4C78D1643
                                                                                                                                                              SHA-256:F858FDB1C279A98DE40F09A0CC53E092F4D8BD4E8F906188B2564039429F6218
                                                                                                                                                              SHA-512:29ADB90D37FC91856DF4D855E3B074260AEFB834EA51CED96EF139B77F92694179EEDACEAAF20C9BAFB2297B04836C2EB04C71B21EE02F859F4D2D74D9C9F0D5
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:h4.\V.d..b.r.(^.L.0.Q.[o`..0L..f.[.Hpk...|.7..n.FL..?..~..T.L)5...>.z5. .=.pw,ss..3O.f0R.xM.. ...I.H...J.o..m.ln..t.FrIe.nO1."_.-...0b...........1........gA..n..{2..M11..=x.L...?R..%..-......_K.S..t.<D.9d..|....(..FbN.l.Jpt....4..r+d.D..0.==..r)...~o=...y. 7..K2%1...y..?h....j......J.d.WL...rg..q.6.jAN#y..j.mG..e...+.Ef.....%....{.c..75..I...Q0.._|b.?.$dF......nZ......0+..N?...r.`.S.o....w.E-.X...}.=d.......V....y.N]........f.[..~|..x..g....=.....=>...NH... .w<.......q.|w<DU........2.....@...Y...9K_pO%.$V...N\........e.1.aB.+..\.(....xV.".B..O+...~.r!.O...3/....A..v.v..FL[.1......l..._8.T3...9...9~.[*avxm....O.....v..KY.K...xB....8p.P...]J..."Y...8.D...#....l.~.6..T.XF!........r:q..w{l..v.|.v.(y.*....X+..f..v..6/.....1o..Q\.5..R.U....q.r...e.+...%rk7...1rY.:..n...?g.<.m...R.....6....0..<WP...!H9D..s~.y...U|.F...YiX....-7.e...G.OR)6.6~R./.%.....Ji'....`.4Z.8...`..U...t..w.......3.6......y.)..v7`5..(....a,7NW..........y<(y.K.......XT...,...T.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Chrome__crx_agimnkijcamfeangaknmldooml.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37287
                                                                                                                                                              Entropy (8bit):7.994548628675242
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:a0GF/Erq3j+snerEUvTpM3uOwUjXmZRIugAm8uYdlYL2:FWE+3KseZvTm3uOPjXmykG2
                                                                                                                                                              MD5:34C936105913E985F5DBC0C9415651E1
                                                                                                                                                              SHA1:F4C9099453B43C35056C3E6D9362FAE6C63F4914
                                                                                                                                                              SHA-256:106B4EC23A936CD7FF150C018C808FFF3F392B4F204F895376ADC910531D9BA3
                                                                                                                                                              SHA-512:34C07534997A15034CB676D8E49C5656F4B7C1FECB2DBE9714833563793514ABB5D6C9E23B917DC38127EE9B1AB17D21A959093DD10710E5206716302F36E282
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:RN.J..<..C....Ur.w...0.Yw..c';.F...T....p.r...r}....yz@1..#.B^.2<X.+.rWt(..l.-...I.Ys.u.z#.8Q.........^.`..Lq`/..b.|.7.H....Ch...&Y.Z..M/L._..S.....p.Q..A?...o}...z5....P.1...B.rT..JO.........j.._.!n}SyWj..a......`nb.y...u.+.?....2.a.oSq2..x..m.p...D7....Tj|..+..5.|j3piu..!...M.Y...$..$ ........}....\...........@...e.....B..."$.#.v.B&.`_..1Z.Q...K.<.#.T.../*q.U..&.}/..2...&.MsAvu.;b...8.Wjx.:.@#H.3`N..8@..*..o...T......N...@gb.%p.Mw7.v......H......@q...5D..1B.u.R..].].5....s{...\.q.._.>...<.8V.G..g]..e.\G...L..8?..2s.H.:....f..Y..I{.t........K....f..m([&.N........C...%.<y.S...=@&..2..X.q.5.K@.v.N$_.A.........oy....Q<[...A....*L..WF.t{....YKK -.X,o*....BF4.DZ...j..Q........j.$."]........,<...[.R..h.S.{Z.9..9..m.)..GG.#%RL.....j...I..>o5OT.K.. W.4.t....w..u.fJ ..d.U.,.........1.Z.7.j..$(....t..qZ..<:./CxU.z*.}N....^....sM-.O.|H.r......H......!..!..+.J........p.H.7.;..Q...6....Annc..>....=.O..G....R.e.D;...p..g..(...*t.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Chrome__crx_fhihpiojkboajapmgkhlnakfjf.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37287
                                                                                                                                                              Entropy (8bit):7.994578776481842
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:bQ+S6+m0rL9Y+Jj4CEeXGJ2Z89QREyOpgXMfGyCX7xTmMhCgyxgpd/rTceNYIm+:bQZNmML14C9XGJ10EyOpDGyiacPzFl
                                                                                                                                                              MD5:3CE426C4DBCA55EEA82E7BBD1BDAC0E1
                                                                                                                                                              SHA1:6062522C470E03799F8756950C4AFA475B462A0E
                                                                                                                                                              SHA-256:35BCFB067C439BC73FEF813D5843A023E0B548E3643FED7EF1C873D5D712E3C2
                                                                                                                                                              SHA-512:DB9E0EF1572E6BA9DD357BDA3263D90EB1B1F3473692A35D3F2033D50183ACAB76B453E340F2F0085637FBF263C4D8975735F726B9CED1EE451FDDA77E1EDD5F
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..vd#,...F...:.y....F._G.iYE.,.....x.K.t].6.......X3....._.....k..O..tQ..0..$..+..E.:n..6 ..L....Z(..w.3.......`".".}[....cp.......(..A..y...TtLwH.PX.....w-...+^.C.p....eh.D..e!V=Q.N'....v.5G3N}R%E...%......wl.,c..<C<.Rt(ez.....G/.....h`mk.|......e4...d...}4.*..->.k...gu.....*..5.....8....s.>..&.&....}+...8.l..&k...*b.$.L..Z....JM.x..h8.....z......>.>.S.....R.......u.%ga.p..`.w.]..6._..V.....?.....E2.....-..4..C.;|...+..?..]........s.T^s.s.A.hP.~.........f.../.F.=.{?...U>N........6v6i...l.P.)G...V.....>..WV..9.....G.dt.......Fn.f..4.\.J...FE...]Eg.s..F........<.....5..Mw8.`=E..6..a.....Hg..I.....).z.9..p9...t... ...!.}...8.U_.. .l7.-..k...7.....w.......V}.......P.....N.l.}..F...<.g.T.|...F....4.F.7A.<..q....EI.vO..y%.^...Sq.v...Zs.U.eu...#.?..u.*.x.=....s..+.@Pz.Z..W*...>8)..7z9....gL.X.dc....I.W.8.v...t_.........../....8...]....Q.Le.$.i2..y..|fU...=..}.c.....s<.f.#...u.........h..2.V..1..mI.......Vk........:U.w...G.F e).........

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Chrome__crx_fmgjjmmmlfcabfkddbjimcfncm.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37285
                                                                                                                                                              Entropy (8bit):7.9951354080799835
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:n3HWaL/wEBjpsPZ7smFz5c+ep5e/zsRPUfCktYlY:3vXsPhsmFNRshUrYlY
                                                                                                                                                              MD5:93F5B4F8402024D401B32A1951E7259B
                                                                                                                                                              SHA1:784642240D395CE7FA7A5A91F5206DB17F2EF681
                                                                                                                                                              SHA-256:4EB11EA31478321F00DCB32AE61DACEF1EE06AD58C12C5E0A93927B94DA5A71A
                                                                                                                                                              SHA-512:C3E5AEABA3102F559715294D540A5ADFA4A95B3362EE0A49B3C0FC9B2E2355E2E6417FF0D9EFAB5484CFC6C620F983E544DDC639E0683E56E6ED9E7C06FBB2E3
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:...Y.u..K.`...j.Pi.;.n.[..~...48...^.Ij.g..o$W.6U....$...BL...1VY...........n..`.%....<..c&.{<e.&.......Nu.u..1o._....*..P!......I.."n.....;..@....I.0.A............Q.!N..)..LIw..{.4....N+.s..0G.B..A..DH....BG.m]SGo{.x5,"..TY.9.*P.....i.g......i-..)a.0..S......N..Ar...cM.<z..M..D.e..Y.....R..@.....&....(4B..:Hx.q`L......4x...|?.`5.^.Y[I.....bc......9.{k.3..C}.....arR.I..i.r....q.]..B3......C"+m..g......>."bN.n...s....s?q.6...xI&..[.neh....j...Q...g.....N3...{Q.0..D.(........i...t..)..!(W..w7....:L{....^yn..Y..X,l.._.F..Rp..2...5.).....KH....q.W.\...l..#.x.\.u....+.....y.......;.....l}...*.Q...@.=...@.s9pB...AN..q.......UT....9.....-.xh......G......;!..^ha..m./R%...z..1g..,0....|M.a..Y.[....cw...4oN...........47..T.ET.......Y....Ka..Y...+.....p2V.O....b.....w#S:p...|/..+......P.-q..8dc.&..Q..CoH..........*"..[..K........%..J.Ak....1V..<....g..S..f;$.......b<.S......o...('...ggY.V?........bN......R....q..x.~..O......P......bF}...7V

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Chrome__crx_kefjledonknomlcbpllchaibag.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37287
                                                                                                                                                              Entropy (8bit):7.995251094674852
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:BrrIh1AHg3EhX+aaBiRy4snsIaP8KCpPuiiNG2ZPRLbtPRxAk:BAfAHg3qcwXsnsWFpmim3hPRmk
                                                                                                                                                              MD5:91D7AFCA8F670AF26256321775A52C6A
                                                                                                                                                              SHA1:0B2BE201858D82E219419C6E667F50101F122DDE
                                                                                                                                                              SHA-256:647B7094E361310C3BAD8E43F720B50C00CA0EA752E4E4830CA7B84AE45A2F20
                                                                                                                                                              SHA-512:491A8ED082E7E1D7AE1EF39E86C9C1E794777E279E6EA17682D42EC3E30A532C0A22D1706419783DBD6245D66C29D5427EA492EFA38A62AFF4FD2A14E26C29AA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:(B..a*!...Em`9....g=..&..%.....b.o......I1..Rm..f......6YP.C1.....v322@).{....*....W.._....8H.:...Q.....4..........-....R...$G..`..Tp..g.a@b.O].Q.h..&X]....?.......Mg.6..VD..|=...~4P....iO...6.R..:.;...nR.....4m1SS..'w,...!.I....9vTVH..B....rB.....,.4...t..aT..m.d3.Q.)V..{.....O:.3..q.B.Y......S..h... W.u..S...z$...J&..... 0..3.D....f.=..@....A.j(.g......P_UL$.;...#2")yM.V+.....!: ..4].....WQ........._..~..=-.cB...v.F...}.Y..(].m....%.(/.X7a.0...1.l:...r..}Lz".F..i~...;7...,..g.P..[..{/C..T...|..2.!.T:.D,..i........E..).......7.....+-u..$..@..^...B.P.]<..f.9.y.M..t.PY.;G'M.B0!...B.vy~...GS.kF|..d..dL;*.Bg'@...1.....O....D..o.c|....A.)S*sI..n..35..q..i..z..F..$m...d.xx.._.6R.y.x....R....)Qb....[v..H..Qk.....;..q.........5.2Q.b...C9..x...(J.<.U..>....pf2C..H..3.O.pJ(.~E....!Bk.Ggd}..\.........U....`.D........J....V.{:......=fq.a.....#..l...1]....1...=......>..&vd..E.Ltt.G%..{w.<7l6.l.....h`.f]%.G..Oy.-.5...^.tn....sL]........@.....

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Chrome__crx_mpnpojknpmnjdcgaaiekajbnjb.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37286
                                                                                                                                                              Entropy (8bit):7.995050671242916
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:qafa5N1KtOJWXj8XP5nemYUAUoLNvLDDmeuMAj4k10kd0/q:qa1OJPXP4m4NvTufJKq
                                                                                                                                                              MD5:DCB361BDDF0C5D448241A3373FFCB012
                                                                                                                                                              SHA1:F5E7A5BF84717977A3482004731F3B42B57C26FC
                                                                                                                                                              SHA-256:9479B2883C5C3CBB9D9F16A255213A0E5B12D15150DE6CB9A642914E5B5E27AF
                                                                                                                                                              SHA-512:2665DA537C6E5CFD703736B7F0A4CE9B954030EED71073E1A6CC81FC271093B381490781F2EA7EAD5CCCEE084A878B9DA122FC71C4DBB5438FFB15262D6065DE
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.. 4/.U...rG.r......65... G..eh..y...|.!1Rt.%........../c.]l3.s.'.&.k.Y4....x..n.l. }....0D.XG..<i...L( ..).8...z.$.M.....Q?.O4...5...tY.....C..".EN.4.n..>..Gl.\...n..SW....jWDr._.......;....+..}.#.....Z..}. ./oA@....r\.re.[........[..zl.N.+._B*.......Zk>(....ZZ$.5.e..s..o..=..\..uu.l+.Qc.;...^.+.$.%./...D.,...w.]..D.7O..A.)%...A.....z......$.b.{.%t.d..LU....3W.V..T.....Ye.o...7..s_.......gRcb}.QS...j....5H..2..11..L.....>.f.............8!gumU..$...O..........;.P....4.}&.)...1=B{..x....6...L.U....)..M.k.<]&O...}..)...SRu......VE.[..\...7..c|:..6C/...2.e.....c.w.q./...,3qbr......F..}....19Qf'.k/2.r.....Z...J.v..&.N.f.KN/..^q.C_o..........7.c...G..D... .z.24.....Pl......cNV.../..^.p...@OMY8...OG.....`I1.'S.0.....>%....N.*<X..=..[37. ...U.l.3 /...C..Y2x.o../.E._X...+.M.Y.5..DD.q?_P.!@.=E..?rFq..../....Uf..D*..'e.M.|M.@.o.J.8...B..^.....e.'.7...z.,..1.q,.d...}.7.Wq. ....2_.f....7e(@GeW5..0..L]..8.B....c.+..U'...zX..;!@u......9V.a#n...H.gd

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\MSEdge.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37245
                                                                                                                                                              Entropy (8bit):7.994754205870449
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:P+eGrw4m6wKSy5XWFvLp0syjuXHkszMLPu60LcnrAVvvePWYh0:P+eOe2SyOvLqVjokgiPaL+AVvvoWYh0
                                                                                                                                                              MD5:15EE4D61361D52CB38AD1BA8500F13D2
                                                                                                                                                              SHA1:01F2449B82D441B5170D6CFC8AC1314709DFE5B7
                                                                                                                                                              SHA-256:6CF3A9DF3F3BDC4C3F90CC3DE467578EC87B3DF83BFB60C900ACF6E446BA802F
                                                                                                                                                              SHA-512:59DC2E9A214A2A8300B0D778C7830990E7DD04D736A00600FB61A5AB84C43695C28B87B9AD5835048C1AE71AB303613D95B253770F2B26F2F53457F9E43C19D4
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.4.C..)qS..K.../5.._9.A7...7r.N...z...__qA`g..a.E..u....p.W\.....B$.0.D.,U.......sR9.dS5.j./....WA.\|.M..B..$.o...7..A~.FQ.X....L)0.f..^..I.>!....%01.v.(.k...?-.8.....A...o.8..)u..:3.8..0......A....l....t.iTc...T......l.:....l.D.36n..o...J=W......e. .l'f(\~.ECpU........Xw.N..hn1...2....p99".G.:......DZ.E..'c.zG.<'.../"+.U.d/.l.K.....&...E..:O.q.....)...@..>... ....K............=8..)..]...."..YkDLU...V.i.L..K.<P...s......b%...<.OH....L..=.[...(.I@L*....?..|.MCep.....Ed.3]w.Y..2....J:....}....!.yu....s..._....... `.bD.Av...A2....x....:..q......e\}_.j....Pp9?....l...x.....l...'^..xI..;..k........rJ...X....'.....P...C..=X...n...2^....nk.d......j.e.z3.`.....u..n.d..~.u0......a.L...cLe.W.i.2C..V.w....zEZ...h..?R...q.E~Z..7.=..I.v..,..zd<..R....G.)#L....u9..k.cQ.../h?2a....~.^(......%....?..H..(....C.7.VW.<b.@..L...n.#._..H..u.f..tNg>/.vq.-.S....2......[...M.....Hz .......:5.@....25")...}|.jZ._......R.....i]..4s...-..4...}.G.k..._.HM.....'.)%t.!

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_549981C3F5F10_8wekyb3d8bbwe!App.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8178
                                                                                                                                                              Entropy (8bit):7.975978645489605
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:1lnWRroWjEqvT7NaCf/IKIflCDDjriAmAGXE12oz0YUEWkOtIAxdZnbLS+:WRroW4gT7NCuDjeAmRXE12oz0OfOtIeJ
                                                                                                                                                              MD5:47B0D7EA4663CCADF944F2F7F5A7075F
                                                                                                                                                              SHA1:992844EFDEE58C00872A0C68162BB604C5B34898
                                                                                                                                                              SHA-256:1378ED711E12F4987F67B2460729A608CD3001672D335E784C5568827DA6FF85
                                                                                                                                                              SHA-512:8B6FD1B8762AB2597F2A875753E075330E761087F8C6664788EE94E549F62224FF84DD7E6339F6BADAAE09DB418296C1EEA94FAE76025AE985ED60BB81917F0D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.h+.f.VX........1.....(N)..3.7.&a4.$.....2..,....x.O..<].........>.b.V....h....C...)..a.'..v.+..Q.9...u`.y7..b..E...;.S)..Y.?....xo.M.t%wA....x.XH...I5............0..v....o.z.@.<....f..d..q.k....=:.........0..^.h=.t1...d..8..W..T..H.Z?Z....k&..........R...R.z....0....A.Bo."oJ.?T.8.).^.h..*.....~VA..(.e...^..iT@K66.........c............k....s..tHE....Y.x..$+..U..xN..8:.&.D8...<3...#.......Y.2To"j.P./....3.\+..3lqhG....xX...JM...qO........q..Eps.!....J.D..~...A.d...T8...(.k....:Y....BH....@.S=s]e.Mi.T}..aM+.4.+....g....n...{..A..lp[..7oF.......$z..b.....F.s...X...-wF..$.B...7<m{27.h.>"%..i..vg.bgR...?...*.s.t.......8...K.#O'..E5.t..D.%.......v.=cH...<d.^T. r%..l3...-.k.......lBw.p..4.i..;K.Bq.....SX..?E.(.i....7.t.#y.i.....3...*I.oL>.i.X.M.<.....3.....A...a.:...0J.~.+x...U.-\........_`...kD!.i....RP&.Y.*..]..V..,.$va..lFba)..;.....'s..pF.G.k!...6...N?0.5!.Q....3js.c61...........2>.RMXt.N^.L.Z...t...!..k.-)...|.7-el.KI.$?8.f.^ntsq..+.;

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{116229A7-9A3B-2078-DB5F-B5A20811242C}.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37321
                                                                                                                                                              Entropy (8bit):7.995481606408967
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:0kBW97fsonBQrm5vXL6PoNqYxFDkT7OWMFZzh5ZbNsMAN9NGGxDQ4gmAq:0QWVfHnBb5D+uFD01oNvxrANHGGxk4iq
                                                                                                                                                              MD5:E363A822A6A2D485DD1CF1D6DD0EA521
                                                                                                                                                              SHA1:0DEE28B6D0712AE9645DC28BA916DBBEC41F97CC
                                                                                                                                                              SHA-256:E75A090C9CC9ACCBEC32B250E3ED1CE8E044B9E9FC39ADD50F34DB7952F981E0
                                                                                                                                                              SHA-512:1890C780193946EB25CA847D56B1A195E8BA97CE9C5D1750B018F8B2AF13F95D41D1F73A95861C301B62C66D7C02018972DC6FB5F80409F2ED85F53F52519A6B
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:{*..&b.W...e.)..,P0......kY...|r...%#....H..|...O.dl.....(.<i..3;..%.o|.`...#.*...r.4.]..It.....6}..........H.L.$.Y.LR..8...s.....2...I..1y@h.^..E.J....v.".'..U.....[L.N^P.}H.U..k2(V!..~.g..?...ib.0....hl$1.q j..uI-...O.yu.cA..$..\'C.|&.V...!$...y..;..U....!..8...l...4....+o....sw.K.ls&.b...]Q.u...T..~'..$....0l.Ia.K.>7R3...-.l,i.Z...w2...Y.\|LPmh....c.v.B...E..S.&....{..^(....(.G..#]..#`.......f..+.F.O.*..L...39..M.../......y-....Mn,.W.[..=.w.p<.kMp..x...... ..hV.j.C..Q,c.9%b....Y....!.c..q..NX.1..2.G..Ws.m.m.......vj...V.h.....P#.:....C..+7h.. $.N"...h|....|.[..2.3..NV-a.M.xA.*...<...1!..5@v..>2......l.|A0....'V.....*z1.fq.9Q.....:.X.l#'...........W.6.7;C....uw...B...).RcS=Cz.T.)...,!.^.~...>N..yS..*..T.......w.h...H..t.<..NKzz...Z}.[r......6d."_.......z......4.6.6....'Z..>W..........!.F@:5.l.o..1.MV:..o.....4.....d._......0ld.P..w.A....=5n-1..AHG.f..,.......=#.'.{.qc....v:........}.8U..g.7<_ .....w....g.....l.O.....D1[-...l

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{16988324-21C9-05B2-CA60-9B4EC72739D8}.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37325
                                                                                                                                                              Entropy (8bit):7.994743900289603
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:AtXgB86Q6seZy/MDhZQGdzm6rEhkBAqU2PlfOh/ftT:k36QnejXdzUkBVrtO5fZ
                                                                                                                                                              MD5:5903BD7A7E274A275B888D706C3EC8BC
                                                                                                                                                              SHA1:DCEE5454FDE011FDBA0C199EBCD5CBCBD52749FF
                                                                                                                                                              SHA-256:526EF2E97E808CF21F7FDEDAAB41652A5B0E3876BCDAC6F40F8BA4ACE82714FF
                                                                                                                                                              SHA-512:8F2F1E4A438322CD15560A3463EC33F9EFE97F840B094C0E612493FB887607C5AE9C80AE9515A198868B8DA281632197DBCD54EE3FB7196104233D1F0C4B94FA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:Q._..#.c.n.-..Q......G6J....3.NP.\5...../{q.../.. ...JAJ...n.<.J.).|...A.IQ.y..YEa.$3.....n../..UV.../8.~...H.7.v9!wL5).i. .gygdn.H..B....5>..;..".......*...@...C->.._c..Q.....w.+ .<Q.2..%.h6..Q..b.BM?.v]_.3(*...y.u.g.^.......'....G..z..a..q..d......#8.fZ....{.g.A.D.0".I....Y.~"T.>.P.M~........d.a...)....E..cV.5.....y.G.....f..J.......|.k........s.R,!........^.]8..~Q....t4.lc..*x..l^%......,._......4(..a`..8.Y,.jgx...Co...}.&.P....("..v....D7d..O.....^q...U....d.O..o...P....^.5O`....#.,#...)G.Y....T/..=?...GM...H4.R.Z.N.=.2/.9.x....2.<..3I.".D.U2.....\.-~.3....^......E`.G.g.VRB../I..l8...Nd..J..(...t..r._...............:].`..:..L.J/{O.<....E.j.1'.....1.{9...UjE..,....^..C.C...h...36.:...v.....L..s....\|HRQ...U.o.Q9i4^I.'...*...".X.+D)......IGb..~.q....H...c..u.>......e.L*........HN.:..`zl.!.".@.!.#.. ..`...l..0..... ..H^"...3^......X.u ..H..7N.k.7O.>./...p8.*..1.....;.UaY...ME.s.U..9.3Jpi.P.y./.4.......W*<op.U.SKQ..6.5....Ex.U.$,....

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{8AA47365-B2B3-1961-69EB-F866E376B12F}.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37325
                                                                                                                                                              Entropy (8bit):7.995348774493299
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:VBEv/l1S0bfKJGv00e+lg2bL53MF8h+5CCsKVXu0xGQB35UtU9:vWlJNl9bLOffxX35UC9
                                                                                                                                                              MD5:1B4A47F23673EFF13F0D0A4AF8DEA2F7
                                                                                                                                                              SHA1:A6CC29C447D7650EA3D4371DF971ECBA3A794109
                                                                                                                                                              SHA-256:6977FEEA24E7AA05912BB5EAE4E941E043CBC2D14B88CF47C11528DC69D15F34
                                                                                                                                                              SHA-512:E2D1D49187F057EA1506BCD1581408BABDFC5F0C404DAF76E7C39B77C0C5E04775C5E10B983B49BE956CADAC21C9A8F1CFB80BAC19474C2C794C06DD4AEFC62E
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:l.ML&.XUu.Eh!....m.F~...y..g.KP2/f.As...`Q'A...;.....%...n2>5.(Wb.*..#...M...%...B..i.."..]......2.V..J.....?T./cP+R.+...H..e.cF....{$...:.LO.I..!...."..PH.P[..3..C...$pu..........!...:..:.]....C...<oQ...[.TT....K....<#1.bn.GJ..n.^.....u.$...N.!1T[....n..W3.nZ...):...I..BOr.+.m...b..B.n.D...*..l.....*"...l8.ay.{.dhvl(.5HJ.i...a.L......p...=PT4.......Q...kl.)..2...v.w......H@hg.uc.i..8......86..x......0\.8Rk8Z..T?......,....d.....b.|#E..Pr2.B"..7G...\..W..R.t.F..:W kC..I..\vMe.M.7....:o.s.E.:b1.1....m.>....B.....}.{...D...>.%v*..z..g..#.IY....0......K.....ek.!..i.b;..D|.[}0\2...../.....94.A2.....&^AM.no.myRO+...&.>z.u.....I..j.1....$P._.j~..u..u...._..(....L..EP|8..q.../m.'x[..s...mcre.>.K..l........E...k^B..d!"....V@.Z..!..7....C.......l=|....`Z.w..U..9@..2...h..h.:A.@..........E...?)..M.\..f..].P.1..lN....M.>.r..."<...A...+.D.*...2i./W....rg$..Z}cb.pI........nt.a&97^.C..].x+g...`..Y.`..e..8..J<......t(Q.(h.....cc.q.P.$Mz+*..

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{8ABD94FB-E7D6-84A6-A997-C918EDDE0AE5}.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37324
                                                                                                                                                              Entropy (8bit):7.995485320463654
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:56dcXuqvEDcc4EEOyb9SYePIkiRCGTOfutygpM3HbYPusbmV7AHq:lu2c29SYePviBTdjPbc
                                                                                                                                                              MD5:E8E13A77F6C046FEB7B5C2EA4EA178A1
                                                                                                                                                              SHA1:A3F512CC8111795819F0C07202A11B8A46BAA357
                                                                                                                                                              SHA-256:A429B6056CB4D5EE8D84012080C26088DAB9FE19889B75B120489F6386098F57
                                                                                                                                                              SHA-512:4CE1E8D2A4CBAD6C8638BF26354C4E2610853D497F0647A48BF0A69FB415D3B9689B51C2E37AFA784CEB8198F01B9823BD0350DCCD6B8E72BC2258CBE3D2214B
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.u.x...iT..^.....l..i".Yi.{.V~~...X...&..9..`....jQ./hT...7.I.....b>.....r..2.G0.M^.}.(..........~..;.@.#.'........CWrY..'.12L...;.j..K...]Y.....%.^...fw.'G7.....1......x...a.+G..@..F....l..m..C...\;^.@M....~....".#8..Ch.!...nI..Z..."9*.p...BH.1...$.3..~...Db..H.J2....@.Oi~Rh.5.86...[..Z.=...|.@.B.G1.,.p.......zN.rCP./r/B.@........v.F,n,8..".tV.$c.R.s..8m.............|hV..D_.......DS..P...9.Vg.=...4..*..:.....u..&."!.._..u....&...8...|. .J....=x...@...q.xls..............!.....M..s..s......c.D.0.;...).b../?.P......U.V....f.^..fK.7 ...z....['Q...R4o..8.-.}..8..z/......5..Q9\k..0....^.r6.,P..8D...QV.1..b.Y@h....pI...C.....:P.....K+.H.*..Gh..L.....]..../.R.....z......F.9.....W.p......Z.v...........A.d..*..%O.......&7...,..>xKcr]D...U;..-OpG.......UP.ai"t.(...f...M.:sYz.L}.3;S....g.4.....n...y.}..y..(w._..... :'[..d...Fw...9|.)x:P;.6k.+g.;....ma.8....k0.......o..E,.1.Z.R}4.~pb......+c..N..E.&.@.3.,"=.~ZQ...%...8Wf.......0.r.d...<n

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{923DD477-5846-686B-A659-0FCCD73851A8}.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37326
                                                                                                                                                              Entropy (8bit):7.994842561071614
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:WwhlAG+or08FRTkHc/WqYYON1yPMN+gbjz5eGrfe+keH:WwhyC/RQHcuqYYON10MNxbhep+kC
                                                                                                                                                              MD5:81969D5A01FF8E6EF251DDBAD0781A92
                                                                                                                                                              SHA1:142392755A534FC03CE67640C4481BB8CA8840C1
                                                                                                                                                              SHA-256:871A8DDC585673ECB849F3C8AEB42D3531F2E03188C07FE154B3B8905EB75748
                                                                                                                                                              SHA-512:EDA9955197E3C5B1AA0624A94F39CFB5BFBA505CF3AA69635F64ECAAFBBBB518BE69A2B3B69CE5212EF0D0FA9D3555E2CC3663740AF7454F210DB74B6F9A8EA7
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.Rz:...A.v\.....M&..]..wLW...j3.xp....m..m.c{]ufP@...M4...$.v.....b(...=.......~.Wy.P..%...r.6.s.A.0 .....j^+....r.@..texI.....I>.2Y...]0......).c.h..$.1~...g.x.;.'..$.q..J.iV8GFfx,..]..vFeg.G.......]....<..h{.5mN;wF5o......4...b,...<?|..5o....E .s.NR....~0.E_f......$.....Q.><.|%`V.r.;..T...sW.FM..qzH.4..e........ z..xf.mQG.TH.....}..f\.V...z..fs.b"k.YSpA2.IBN....&D..0..]MTN..K.....1H.E...o...<...0.1..?S.C+..KK.Z7...L...P'..?....k..!&.....p..q.T.."...M..v.(.oT%.2,...xw....._..3i=Q..;...Nn..Q.5p.i.<}.P...1Q.G%....}u]q3..j#.H'..E..-....e...!.B.Ha4...c...28..B..'......w..y}.....".G.e...j`...N%L.6.d...{.....%oE.is.v..|Z...6.h.T.,....#...C..w.....{.0".|yC.8=L9..=.`.i..)=..:.N.w......W.._}.>.z7.p".k..,......x.h.O\..;..Sb..h.s...I..?S.)d...Mf..1.....py.....P~hPP3.TQK.."TL#.......Laq....!.gF.`...v.....V.I)i.>.*.,.1..a+./Y.h...r....I3c...].b.Q..W>.,...1.Y..!$...l.m.Z.......Rf^.lL.._..5.A\WL.Q.X.../.Q.......~D.*9.0.9.K.P..X...U[.@..S.v.'Ffv.vx........1.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{BB044BFD-25B7-2FAA-22A8-6371A93E0456}.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37320
                                                                                                                                                              Entropy (8bit):7.994346980966093
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:pJYIvG8xtsrr+EyvBeHmCNClVC64dSUMeCTGqE4/xRf8Lx:pJ3lGn+Eyvzx1CSUhGR0t
                                                                                                                                                              MD5:28CE7787F65ECD786DCCAC80245FD169
                                                                                                                                                              SHA1:7304391F335F8F252973970F9DA3417FEC93DAC4
                                                                                                                                                              SHA-256:3CCDE57591FF5083ACCECC5D7E17BBC205DC3F0B91FAE1A8D7CB50E2EE178038
                                                                                                                                                              SHA-512:4EF74EE4ED270DFAE68B3D27090D20A6EB8DFC39DE995F274FBA8879B212243DA989F85FD9702E3F74F28B3010610A9CB5D9BC522CBE0A38096B7A14AC3D8749
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.cr......Gl.w.....oP..g..9\...~W.....+...i.*XJ.....;...H..6f<;...i&........Z.RwK+E)[...w.I....}.4.(Z7..5A+s..oQ...v.w..q......K.."./...o..]..1....Y.l....gO.M']s...g.|.....&...p=...L.f.=.A.d.....E..Pg.S..."t.)6hs.1r.s.........5LQ.y.Y@K..sy'.!..ap..^"..#..C..u...c.gt4[..B%..z.n(..#...B.L..5..K..o..~&.(.-...g\..a......j ...%.Y2/..7..1..9.. ..G3U4!.y...AhY.C(3..G.Z. .].OWJT... .(.....7....h.:x.L.-.8.<../..gr....0..Q1.-D..3..H..0.Vx.v.LH?......M...S..2.`....%.....s..J....N.>..YI.:..I./m..<.%.?..1..Lt...5..8.W_-...z8..../p..w..o..~v...| ....Yl..0}.....xRmY..P.c.....kJ,..V...t......\h.z..~.".*.....>.'9}aP.J..dC...a...oP_.i.g.rt.o?.l.....,.jPpi....[..U...v....(y..41\..73qg.W.R.._.(.."Yk<]...{Q....$U.I.3*(Iv.+.|..A...v..L.`..H....G.x.Dr..........~..`(..,..x......HD.A....f........eW.T.@c."..e.G....qY.....II90....*,......h..7........dk.<.7.Re\...g.......m.5..f.a.b...<\4d..,.?V;;.`...<.._...6.I.....w...K.....1.....9.&?..kL}rd..n..r..X.I.....7..

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{BD3F924E-55FB-A1BA-9DE6-B50F9F2460AC}.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37326
                                                                                                                                                              Entropy (8bit):7.995362278611045
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:Quoai0j7X1hAS8O/M9c9Z7GE+ry/icb4Y7nMDxf4+QLVd84vGGY1J1:QuVi0PX1h5o490ry/IY7nMDW3vGGY1J1
                                                                                                                                                              MD5:5ADAF907383006D14A115A8E506377CD
                                                                                                                                                              SHA1:7D26A6BE1B9DFEC80E474D3C5B0CF08F61E3B0E4
                                                                                                                                                              SHA-256:0BA7C8553713735A502021296D3C3C4ABE9FF27433CB8D9E319AA2BE6A320DBD
                                                                                                                                                              SHA-512:FB9C7D832D1D6AB93264377E8434610C63E14154744BE2306B03B4092045263E4D3FF0B0D2F7D3D89D3C817775B1776D1A9DF9A8820E18C7B80AA45DF5CDCDCD
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:...(.c'.C_0.&.5.f.s...........p.LB...1..[..y..6.Z...x.W..[H..16....L.%.....}.u.LItj.{..u.5.!......hU.\..I..o.[..5M.}?.d.....k.C...../.......q.e.......!....lG.r.c\...0%..63..7J..$3.9E%.#...QE..,.........~..#....^D[.YM...vH.LdyrS5......K.^9~_.JY............0&sB.WP.%...6...r.1)...|.C.Z*...^..<.u.>O.....:..)..).k..N...Y....h.9....{9..m.Q.]r=.....~h...s....ImgQ..>....{%eb..S3....V.d.o..D...a..# #.$^Io..;.Xu."cS$...BR..U.8...|. .wl.H..Q.!.r9.0d.....F..nO^.BI}......7.NeP......^..........#..-.,..G3a...")...n...g..O....n..A.q.3-..r.......M...e.S.d.Vz*.7..|...K....>..i.#L.A..4..'.".R|.5........)..p.4J=........$..S...c..N..f1.^.-Cu..tY^3 .z...j.i.4..R..K..G...=...G.[....%..C..Oe.i.1..t.v..w[.Q..j.e..0oO*=}......ec.pN....4b.r;3....j.9.4.~..^..j.~?..B....~..Ry>Z....g..e.....N..@...3....R...,.7...1....5.I=.$........D...y3[.z..t.....j......w...^/........-..ot\.u=....p.......7.@=...Aw.....G[.V2........G..l.PL.../..I5*.^...+...~.z.....F.N

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{C1C6F8AC-40A3-0F5C-146F-65A9DC70BBB4}.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37320
                                                                                                                                                              Entropy (8bit):7.9946931597269995
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:8ldgZkjy4sGKTQeg4Qqj4uSsrHy6Su36BqPDz96W73PJIx:8lSiG4sGKkj9zuSiy633DDBHTRIx
                                                                                                                                                              MD5:5CE544414329B418470D075A9052C4D9
                                                                                                                                                              SHA1:2A4F648BBBE7C4EA099D8A2E65A1C74BAA3E382E
                                                                                                                                                              SHA-256:3136E22E9377B5999BEFF73A549BF3A6097B90FF1F7AC9C06FEA39C5F6F6B5DF
                                                                                                                                                              SHA-512:F75EE8C571E948591210072235563D3A2BDE7FB139A5469086920E299561DF135197818E8E5FF5009BE17CEB49AB5DBDFFF0D78CB0E6C70EB694685ED181CC9E
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.....H..........!P.k..y..W.e.W.....H.4..lr#.iS..r.r..q.m^LJ..I'.........4..F........a.`A.'......c.0.a.(ph.....-.....2..!Fvl.$....Szm\..B.....r^n....F.@..8}......gMq.D....o....Rt..|.^OR..?0o....C..9X.w.6...x1mfV.3.L...P.nB\.m..1~......'..\....0..8%.-. ..U..r....olf.OE.M*.t.....Fvd..6.....\.@..f6..... .}_/=.......p...=^.B!.j...M....W..=T._./..x.g......G...r..q.....m2_...&.g.&.$...q..v.r."..........y.,a.7./..S u.....7.......-u...`uI....U...:....@.q..&GQ$.`.....>=...Mp.; ,.Y!..L.^.8s.njqP.%.9...{..hk.d....*V.........[.....~=....!.Y.................En.O........P....t..}h..IL..+.$....3b.?=Ce7....1...]j....\..VC...r.....GM....N]..rc.~...........W...k..$_b>..h.(.^.......y..t3zL...,...L7...e'...:......B..9.....f...q...A|.T..T.....b..2~.3o....H..B..2...@.1.....n...6......UZ......9....|..I...0<..X.y..t\1l .,..wl9A...2..y.....R..a...YgL<......qB....Zz.p....W{.q.b_.@.!./....'B...le..S.........U.qL.....7.-...b....T!.o...[d6.>2.j......K..

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{C804BBA7-FA5F-CBF7-8B55-2096E5F972CB}.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37322
                                                                                                                                                              Entropy (8bit):7.994383438539469
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:YN2A2mNhIb8M4JXVhFid8gYAFi7j8lRMMi7zE6YrXbhqt7EMetWSK7hEU:zA2mU4M4JXVhIYASgl6hzEJst7EYSK7B
                                                                                                                                                              MD5:A013892EE35A93ED3143DDD78041FB73
                                                                                                                                                              SHA1:5D0CCA04B6631897FC5EA45CD07C53FFC86E914F
                                                                                                                                                              SHA-256:CFD6A1C1B83C17359A2834A22541748D7395842B80E5221CED6F993783551A60
                                                                                                                                                              SHA-512:503D757FA03263FDA5ADD1779534E165EE2513ED46D1E6AFD331057146DA5D77D42B8D6EDDB5FB26591E8692CF8614B04BDAD9764E4BF9C0BB77ECCA28456A36
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..y.......d.G;h..:.eH.....+<.......uN&|.rl...o.).^+..K"0-A. .....v#.;m.z.8{..>.u*R.'.qhK&..fSO&..*.a..V.1.........c.%..x.`.q.hP(...h~.dLA.....o.N.......;."...h......J...7}.....6.t.-~a7..qZ.;....?1....}H.]..Rnv........A.hF7woZ.4F..A...Y......pK.....%...k~../U.c..mF......E.W.E0n. |a.&.wy...5.j6....CY`..v..6....nn...J|....V`..X....}..BL>.#...5..d.z....y=.JNe.3.U..&U.....h.C..9...].#fT......)>d#.....!.......^....M..>DXu.Q.....^....7.".-$D$.0]..m....y;..L.@C...J.7.b?..(..k.i..CH.}G....P.TF...n..8..g.......2.H...soF.............9.u.P.y........S. g.)..UO...~..v..a..H..c.IK...gX6...qM0.....B.Y..pideJ..~....IT...86...,:...5..(.,.$;..]'.:....2e.F.%<.....9.\.Y...3.q.h.$......c&U.bY...o.V........._G.......L.}.%rX.`.|.c._.p....lQ.a..../....Z.....i.WQ.p.........gb..tG.....F..,.k.S...L.9...[...j.. .......O:......tD..X.(.%d..V{...gU..N.tj..e-($....."..c=.......#.AT.A....v.@=.C~....ZU..J.~DB....cQ B_....C...."..au.hYx../.......]...D.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{DAA168DE-4306-C8BC-8C11-B596240BDDED}.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37325
                                                                                                                                                              Entropy (8bit):7.996000038649083
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:82eUwEf3bQS2iT02wzVODqlG/Cj01O35l9okWvwk0MRPg7ly:82ePEH4mUCIr3Wv5u0
                                                                                                                                                              MD5:49F1F08A391199B646A5007725D9C14A
                                                                                                                                                              SHA1:5295F5FCF411C94D811240C13C4E62850B80892B
                                                                                                                                                              SHA-256:81D2203BD21071093552ECA9AA369467BFC37261000C9C1C7CB49BBC58AA4268
                                                                                                                                                              SHA-512:9CD8F8B3729413590DB744ADC6DF7BB46EBD239A9304E3DA282C07BAA54DC3518AACD288B8587BA4A7A376CA1419DBF772268D1BF8472F236743A9C28D9BB796
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:5..O.M..W.."...5.@...OR\k....)Zs...0....o.$.....T..`i.....xA.i..#D._P.=.!...L.O.iI.T.....R.#u...]...n-..I$....lp.bz...3...Q.KI1..H..r..m..c.L..Q.}.&\.>.!}........VfC.....'.u.J...k..V\......U.<.f.9...t....n.mVR.r.....$[,.........u.\...q.KI.>0Z....o..d.rcDO<U..vz....9n0.7..!K.[..G..i...&..LDL'..Q.)..[~...&..K..X...v.g..42.$.2.<.d%7.b..Y...TJ..b'.>B4b/|..1.2....G....K..Z*A..e.~..R.q...A~...2...3.7.>.lv..u.\)......+./..V..-.3.....6o.?...[P|...LE....@.3..I.W..../.x.......N..+..m? j.'.e.@..2..u?.I.yg...).3.X;z..............;L..lw...}DZ.e..d. ...(,.r0.M.z....*=V.;.~>.H.u....)]...}70.]..(...B..?6rD._..*.a..{...J.X..,..... s....d..H.i..0...*c..$T7..(%'.f.M....B-YW...{W.U_#.V.I...l...P.'..U.x.j..._QJ.n...eO*..:!..*L.@C.md.w-..N[..p!'........Y.z.J..80..o....x..@&9.tq'.Hh...q.l@.Q...#...V.Y.....,.....=..u./...+.z....a. .%..Fs".ucrC\..S.._.U....!.......0....W@Ah..7..........y.5A._k.1UN...i'..C.......)........VLC.{|,g3.....N8|.`;...|..%....C.3i?v..y

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{E7A33582-E908-3379-5368-5999454DCD83}.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37322
                                                                                                                                                              Entropy (8bit):7.9952130244620365
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:+yBjIwfYiOYWiELoYBGg4fgDmLD+Pu9pigTzJZLysR4:56wfYQWiEUYsg4FLDg4TysR4
                                                                                                                                                              MD5:352A087BEB7CC81B6C9A1461D8D3B188
                                                                                                                                                              SHA1:8939A22CD7B98C5656D1356AF0D0D88A9BBE2511
                                                                                                                                                              SHA-256:A90B8546CB89E82F2E6EF72C99E7AECF35ED27F5D2685E4D754C895F108B1E01
                                                                                                                                                              SHA-512:8D4B3B1829F8DDE45BBF36DDB9B314A4E5389FE70B24E65A5AF42B3ABF010D65624216C41AF432A5CC012B218A55C59980B633451C0C52C4C4C32415889E0C9E
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:Y..-9-.....nE.T...u.^.#>.,.M6...a..FW..V9$-...B@.X.....Fc...f.J''l..%...$s>..{...L....e.U.../.p.../u...b.ds.O<{.x.2.c....:V._...[...}?.....t...#...[...5?31#......W-rf.._-..(.w..b....F../....xx%.Y.ky.}.v..........$.........x.-..."....N.#...r.g.....x...b...b9.3.H..8.*S./....o...-v8......vf.~DR..s.D.+....,.x..>...I.........tv.I........i;.....l...+.[......q.u.3 ....G......2.....XA...{r.]eP.....b...2(.......9...;.....+w....'/o.y.E..m.....RZ3.f....;,.1.?..v..+..MiP....^.}.C....'y....?.MN'C...........[...I.....BC$K y..g.......y.+}y..B.\.....ew.r....\..x..S...-1.&..*+D.f.g.;."...Gc...>..y....~..-H..%........[..+"t.f..l.7.F.%...z>.Wro2c.=.>.$.G.Tj..+x"b.........5.k..Re..nV_i.......Q...?N..E.......$..^Vf...ox.B..GD*f.G..m^E28.8.&.?Lp.\@w,.IX..&=z.'.4.E........nX.^M{..Vo}.,..+.f...{..i.[9...39.Q.....r.3...1.r..~3JT.*........X..r.#..K...2. ..l5p...mZ..d$C}l.C.6HeO...Zw....RF.H).@.>...Q...z..i.[..!^.Pk.8.}.}....&..^p.7...{u..P.v..Q...A...s.O[vy...

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{E8B84CFB-B069-BC13-F88F-170904F645E5}.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37324
                                                                                                                                                              Entropy (8bit):7.995379491051628
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:wytkqHShI/K1RrKKo+ep0FDJN/7DZyj91A6M5QUhljL0jMZ0+KchJNyANCli:9tZShI/SRzoxp0FUj3A6rUhdL0HvENCA
                                                                                                                                                              MD5:3C6F4254BE4D7356263A7872F7D4DA49
                                                                                                                                                              SHA1:90B1B2ED50F36799494AAA87C23CF88581B18BF2
                                                                                                                                                              SHA-256:D6130BCEDC2052F46353A1F16AD42305141B97EA0C3594B1C7C1E50094BF0996
                                                                                                                                                              SHA-512:66C17EBA2127438FA4601411FDF592F39BA10EC7C135257AA41DC6B58F3A36C8FBD0F07F5DC76F698177CB9A859869F06B52A719853AEFCC5A71884659AF4F39
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:....D=..TB....l&........%.se'.O.\.l.lIe.d...A(f...++......Kx..o.......\>.9.B..K.g.l.(...h5.f...fX....&.Wy.i......RT#..K....a..3...}q|.\n......p.g...Zq._(.m...9}.R....-......_...1.~...#..D....+GH.5.&.......S3.,.M.t.(>K>.M....U.d5u...U8(.....e.'.......Ak...x..`fP....`.6..-..jxy.cP.....WwT...D]..:.t.^..\#.&3....H....W.S.h.W....~b..9K0.{.t...2.n.~v....0m.r..W.....L...*..k..\....H../.j.....KgNxi....|....>/R-.....].@%.%h../.R.....XQ.......e.W-..G....e...&.y.aUP..'..;[B..2 ......j.H..E.).Y..7...v.,.eR..n.RZ.3^....>i4..x..+}3.k.NM.:V1>.....kU|.z..ir......1A.x9.fw..Mg)%J.o...].F.f..l.L...n....x......U..Q..%...d@P...`EuP..W...,.]T.PH_i...="....'*j,.I....~.s..>..G.........}l.x..W.d.usqt....&11.h.....H..."."b.x?/..^e.^.a.^..._C.9....&..dM.T..Bg.,x.....*<3G..}'!.._.^,,%8._1!..$.W2.vl..8............ .E.j..8t.q.#.{.@.a........^[q....D.SU.:2._........q...(%.G.....}....L..K..)4S...DT.-"Y..k...."D.. .....~.F..."4c...q../S..-...4.L..R.e....2'q.P....

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{F1118828-A0CC-5FEB-85C9-DBFFDF98434A}.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37322
                                                                                                                                                              Entropy (8bit):7.994918699860482
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:9VJ5X0AUY1whT0d7Vl9zK47IxxcWX+ztf8wbMKs/etmrkUo:9VJ5pwJ0VTqxuY+ZVMH/eMIUo
                                                                                                                                                              MD5:E77AEFBE8A94A92FF19E29A7B1598C61
                                                                                                                                                              SHA1:A91C54A4AEE490EB0151718658B094C1FFA1E573
                                                                                                                                                              SHA-256:455B8AEB5FEE55C10C67EB7D6775F0BE46E8BEE4E17A73D0ACF8CA2FB2048B1C
                                                                                                                                                              SHA-512:0A79D94AC963EA92A4B836F918F1C22760A2B72FB1CE8F69F0BF12C8A301DC38EA285FE4870CE9E927663F3D20BAC78BCDE130BAA82755BB92361BB8DBCAC4E2
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:...XN..]..........C...u.(\`^x...~F.."\..b.iVh..p....Dcd.XWJ..... ".l.Lvk....y.4.$7....i.....j6.5..a.^5.....=.L...+...2,..F18.T.n../{3...0\2e.wh.Q.:..B.....:6\...,...v....|....0.rOkvUZ~.H..ZTybd..1y.C...)A.oC<hJOT..w..(tO.%...8B..pG_..0_0*.S$sx.g..! ....3F..F*.3c...#q.Y.0 X.p.N......e+wYkT...0I3&j\.O..84..2Z.=EK+.......#R.....2.F..}yP8%h...n....xr|..'.....L.....#.I....4<%.h....9l..B....1@p..]...M.:Q...-.Zn....,.b..g.:....W..Z*...c..!..s..@;.....?...t...o._...v..D.([.3%2g\z.Bj......s.ru;.;.o.......)...B..!....*|..uM..V..>.....(..(..:)....'b;..sL..L.iF...W.4.. V.K....AmvE..b...L.Y.....s..6... .....&I...g....4\.@..*P.....s......]...Y..Y..5.$........Cv..]..^J&..A.......0u_.e...-g3<.y!..h....?.k.bf..C.@.1e.........77..$2z...d.p.....=x..9.S...`.qN4.y.}....Sm...yX...B.kx./........0...\.!..ww....D..O..\.~...Y...@3..z..n...N.Q?N...i..e:..~tX.M...C~....s.C....%.x....J.1."Oy_\E..).5%vl.K..i#.!.6.H........tU.^..)C.%..z....W.@/.2f.K.8;..Nm.w.x......

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_BingWeather_8wekyb3d8bbwe!App.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8175
                                                                                                                                                              Entropy (8bit):7.972776345880441
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:1M7fWwHXCXw09xRYeucJhw/WLvxQ7N3RadeL+:yDWwyVy7cCBad4+
                                                                                                                                                              MD5:2A7ADDD80BEFC4D66C07D898CE67BB93
                                                                                                                                                              SHA1:6A5716030E6DA58E668D25CAFB116881032FD5AE
                                                                                                                                                              SHA-256:FEB654F42B7F64798ED6F9F890672E6FBFD4391D0CFFEFF7559BA1E50F41E1E3
                                                                                                                                                              SHA-512:78E0E0B727591561DF4320CE76E86DE986B418279BB42FC67BCE48A03F9DEAB662BA0E0555F8153416668FFAABF77B6848E366B2F3DB9F3329F2066818A45FAB
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.:.V.p..b...p.W..U...F.\.>V.d].v..V.{>k.."....S.........k...[.,...._..E.&.).a.....8'...@U%.y....0{**....Lb..KBt.h.R..H.....r...j1.:.C.[.Bh......W..k<9..Y*K..K..L..].....1..B}...d......K,C.n...:7...E.v..!..c..g.."....=u.....Q...%bF1.II<.V......+..E.\....L...x.I.D.f.u4..m..z......_4..X.k...... E..]..D..(jXVE.2D==H....;.p.k.RF..=.#..-K...s.Qkc..g|.oWz...MU..p.G.>.*..:.A..IO...V"BV..:t...s.:z....._..<._.=y.4...Y.U..;*..Z.h;D....`.Q..j...=+..~..It.|W' .....%..VHJm.:D.A......|\0.~...h_....F...|.......Y..2....#..BR...z..C`...Cf.vN.-.^d.-...[p........`^.Cy$KB..nu.=...1M........s.(1i.F..$.y..y...i.../..D........+h8W$..B...Bk.................y...d.....jO._..&..]......~..8...$`)V.N.\#[R.[...8.....n......>.T.^......F.qB8....*yu%.eT.P..Y.l..V.9.Y.(..7W..r...9.(@Y2{.o.b.d.........n=H....._H.x2|+0....(...W..R...M4<..o.L.K..Hi.T...v.|Q.b...D..-.HJ....6._@.<... Y......_..P..d.....f .J..(.f.y.G..X..}G&H#.......S..E!Y:...c4.C...-.Q.\.N.0..p|.5W.M....C.d.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_GetHelp_8wekyb3d8bbwe!App.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8168
                                                                                                                                                              Entropy (8bit):7.976917166640351
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:/Pz90wQGSLibg0HwNRbJ5LGkFrJTV3vG+J6FVTAkGTvoU4rgxJJ+:/P/QGSLibFwPzLGWJTVfSLTARgyD+
                                                                                                                                                              MD5:3DD2432FDD89F1797CB77074F76F7C76
                                                                                                                                                              SHA1:8686941A2E142701B7720B994A179D7382CFDF36
                                                                                                                                                              SHA-256:BA571639B3F8BAE4E007E774CBBF8DDA1D6AD17D96B53F62E02B7CC2FDD38514
                                                                                                                                                              SHA-512:3FE73FE7163A96CA867A536CF29896A6C4DB50480BD00532EA05EFC00C697C5B07623A32876FBD9BDBB57E2F6EEDA9B8587DB8B27FC5AD666D9BD68372489AAA
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:UM~._....]d.'Ew....9..6..D.&......dV!../q.@.....IYluBUs*.Z..$.t7.t~{-sLM.C6Uww.y...r..z..1...`.3@{0.EUB...o...+o..y.f.....g.2.3..X.+.../.u<.L=..N.1.1S......*.V.[.T..SP.5o. {.n...]....B....`;..X_.=...Ya.<n#....h...K..c.%..3k....l..Cw.4_..1..h'[.s....E.lB....2.x..^..U.;w&b...$&..H.E8.F.O...M1.);.p.vK.. R.F+...................i..O:R.i.....l..j..p.Y....!...&.r....<.m.qa..9...v.b..9G.Pj...K.O.f.-.c._5..>.'.)..JPc.1A-..is.[8SDG.<+9WuU.....y.e...[...;f8..*........).Y.d....DyB>.....Ja.v3.......0..F.>(.j.T...t2.../S@..2.#D.L(..mx.......PqH....]..gof...t.A..,!..P\....P.F.,.z.&.....O.....%$p.....?G....by .....E0.,......]`i....R=..2<..8.Z..l.......P.%..nZ.....4.TWL-C4.=...&...N...jA...J.$+'.#..`j.S.z..&{..?*M.Cw)..T{}.Rll..Z.Od.......N..........H..K...{...^.....`~ur9....%/......OG...../.p...._m...C.*6.1...}!.....!. ..K..Z..._.0c.3v.q.O.e.x..".:...dzg...1.........m....I{....Y.>Q....s.X7.?.4[.5.....;...9.......i..0.v.-./dj.a.m..)..r.....!+..b..:../V

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Getstarted_8wekyb3d8bbwe!App.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8170
                                                                                                                                                              Entropy (8bit):7.977498618880924
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:4rxWXj7JmB3ywSEtbINMqbLxsp8nMrd9QD+He+:49WXXJM3/daMlGM59QD+He+
                                                                                                                                                              MD5:916C22AC136C100881D6920CD8419B6A
                                                                                                                                                              SHA1:4414C66D8D054F0ED7403E5131CD4AC2FC6C2469
                                                                                                                                                              SHA-256:67A625BF3EFCC012445BC86F576B88333893CC47045BF0838BAD66A19E4DA85E
                                                                                                                                                              SHA-512:5305B44DABC22BC4BC1E070C8669C175D31A4832DCF0B1B090BDE505171C484DAA31AC9433D752111BBE0532AE78AFDAEBB4FDF0AB9B072AEBD1A22F6CB30113
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.JK."J.\F@..]............j...+.n.......vm.1..].1....J&..$..Pg.*G...r.ud.[V.x2>...D..4..J<.u......=.../X....D.<.o.RU......?f....q.....D)Kd3[..Y;.y:...R......Uy...xj.e}A.^.)........7.-N..O..D...'..).........eywY-0........A.*c..u...HcYfp...T##".K...../tw.6.P.k=1:. ...c...T..h....Z....g.<=..C..F......[l/s'.{.6...8O.-..c.-..g./AC..6p..p....&-+..9..IK..D....5..D..o....g.U7.C=!..M......u..]....#.......9o.X.qc.V.o..,. c.K..kG.uD.........T.M...:P[".d..B..+...0...Tn..!&.g...'hJ....5..F.?.( f..?...o..b2...4...H../\.z.6t.Wn..U..}..3J7?...)......`M..c....tm!.2.2..i..b~g.-&.a._.F..q.......l.."J'I.D8..P....M.9E.xN........U/.;~.=..............=.....t.i....>.....?f<_...2:...fb CC6]<...R...1.L...T.NQ.~r....;5...W...Q..Fk..V.B.rl.7T...k.P.......pM....T..1..$...q.....}`VHQ4:..BD&..C3...k...........=.5X...x..Y....a...p..$....h...c.a...ZTU..h.:7."I@.'...gL..z..l.-.[....'.....)G1.....w.._t.de.9..Q..=3......5p..z...;.....q.7.\R.y.8y4..tt....9....Y...g...E.Y.*S{..

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_InternetExplorer_Default.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37285
                                                                                                                                                              Entropy (8bit):7.994713489722457
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:k0PA4a9xxmaWAoBsQx2jjXddZKQXauLDGwmfldeKdq9/9j:k0Y4ZAoXEjXDXtp+ldeHH
                                                                                                                                                              MD5:2D7DC9B6D4C1A5ECD861EDAA5D589877
                                                                                                                                                              SHA1:184A5D19605170B79D341A2963FF4AB4993A38C2
                                                                                                                                                              SHA-256:1272D6A394F18DB6D658F1D0069592B2CC3CFFE8BF6095550DF20397D11E6A67
                                                                                                                                                              SHA-512:D7DE391CF9A626CDB175E1B7CCFE574509FEDC63596220607C3E365BB0DCEBFD35AD01CC13BFDECB6C615A19C02EE60F26118E91FEDEA68C973F4F0AA046781B
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:%8.*m=.j...2...c.3.;.1.;..K...L.0......3S.&. 9.......6.fAu..j....g..........t....\...v...{.>..V...L...-........'...3...f.....R...V..m.>U...5i}.w.,.. .....Ln.8...)?h,L..$S..9-..l..p....&.J}..9.p..$,H..Nr....t>......~V.....b...........28..[..k."...h.~....:s../.B+.#cW..4...U....=4..A/..`k..\...~....uDa.~.@.e*.*.-?......`......63..o...h...E.....%T...L...$...u..,(.d.X..c...}.P.V..I....fkNz.......h...S.)..9.(..'.ZZ...j...!.?-...zWID.#.....L .~..}.N.b"C.....H.r..x...Sp Z.....d.K..{%r........dt...m.U$...Dd....g.U\.z.cr?b..).....x..w:...s7*...{....z.Z .^.w.o.-.....kx*ui..r..........-.....039..:sX%@li.P.+..M..c..e5.1)..!h....6..%.zR...LV.Ac.c....>.......yB......E.fz.[.._..a..x.C.M...W.{V..+0.sn'....M.=u..W}n.....p..=..cA.).#Ju.IcB..f.u.'.?..ozw`............a.......u .....8q..c..m....X......L..H...j..:G.H..C].`"...2|....Zl.G.j.wW.,.Kl.M..z.3f....)....fT..O.,QvL......v.....C.`US.R.n....n*._i.J;.........u.$.`. ........n.m.r......Tsbe}...#....I..(....

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_MSPaint_8wekyb3d8bbwe!Microsoft_MSPaint.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8167
                                                                                                                                                              Entropy (8bit):7.977764273619279
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:fVLlq21YvYToYkRdT39IpO4MZwT2yet8X6R+J7HfYxg+:tLl6vYToRB3qKZ4et8X6RGYxg+
                                                                                                                                                              MD5:0F88AA146A84E07A1A8C2DB25D5A4C85
                                                                                                                                                              SHA1:3947681EEE18FF288D82CE314FA4FDA936622057
                                                                                                                                                              SHA-256:60BB3B543B89B9CB99C9C3CCE777C979F11CA2B91B276FF24CEBAD76DBB406D9
                                                                                                                                                              SHA-512:A359E52517B8FA2D6385BA8B44FCA883FD40E6103C7B0F78FCFFA8750271A8BB77EB1C4E505AE8FF515B0E7EB3A59AC85120818CF3E728ADB50F99A3629E86AF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:4.k...!.o1y|.........?.9..{@P..."...g.0..m..*...,..1W$...A...u.{/Q.^..t.I.g............d.>.J.......).@.7.[.......%.d..'&.....#.....O..}s.".F...P.N.t...#.yv...UV....P.<.m.c..eX..C\h.C.....h.t$j..[..G......V.-...^..!.[......'K*.'o.c...6:..u.. .?QFi2.../~...k...0...$tl(..=..}.tL@...y.8.=...V....0.#..)..$..r^.}N...I................8..X..5d.....Y%q..5%,fr..+.t&.(..yuk.j....QH....6......R...*M...{9......u....H.....`..mjH9.q7A..?.\f?T..........K{.`i..>.....^...f.v....+a......:...J.....Z....9@.X.....Gd.?...ct/....Vh|.i.(+..%. .mr..9.o4=.....%...Q.a...t].)>v..P....i.V....u..Wb .$UCb..p.w..v....[.,Dm.A......\.."2...o".c...;.7......{..........Q8x.,N....j.bX=.L.~.....p.Xnj.d.<...M.7a~...".y+.......A.%./L..1.$aY...1...O".C..X9F...S.o.?.{/.8|#........M.......\..[H.P..h_..g1....u.2M..........7.r..l. z...^.)KD&.......F.<.f $k..=.Q..1...ZY.X*ph..(.a.E2.6L5..N..4(.)....c.`.>1...........f*..0.j.7.ewC..C.ZD.y\.!L%].G.<.D.R\..sG.3.....T..IO....7.i.P...z..?..[.#.L..:

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Microsoft3DViewer_8wekyb3d8bbwe!Microsoft_Microsoft3DViewer.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8168
                                                                                                                                                              Entropy (8bit):7.9807561150879405
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:gGUd4TzTtlFvboonSy9P21N6fo947e/81VOt+:3UdiHFvbrn9e1Jk1V0+
                                                                                                                                                              MD5:15A9F719DFACB929CBABA626FD36B328
                                                                                                                                                              SHA1:16176DFB705701BB7CCF3F1E7F8978A854049379
                                                                                                                                                              SHA-256:73D37B7E7610653E03FE1271B072DFFCA7CAD3FF6772DDB01B4BA54F3EBAC450
                                                                                                                                                              SHA-512:C21F23F543C1297C252DA772472709CF270B8C4574E7ED4743A4D1EA2FACF896CC4A25F50D686F9C95307E70F8E9986EFA4CC7FF4877FA362CC1401CB776364F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..^1!..%4...0.j...'........s(..0._...q.34d..s..I-......".Q..-.%(#.D.>.>M.U.....U+.t.h....~]L....Ci$.j.....7o.....=..,..[U..$d.t..W...[.B....I....P.D.."...|.:.=y@].D.(.8.b.#0...9.3...J@&......S.ob..'......-..d\k*...F...p\..6...!.........6...n.....:........iq....z.~.W.cr...6.J.E.|`B.d2.zw.1..PSz......O>.....z&....W..'.[5#e@y..o.. .._z*`cF..(J..&CPS..-.^.."[3.._.{N...b.z...X./............U<...m 0.5<.d"..%.6.....b5u....$T....... o........).cQo.....ap..%|....f.`x.;y....g.....&..._%.f.....j....Z..y....`.,B.M.D.V..,'9@..v......%..#6Y~...IR5..o.w.4..........u..s........:c.......B..v....5[......jqa..|mi.C....xt_.*.;..0..O.k....h...(..a.}.q.D.<..k.}`.....}\;..M..W..d.....E+..>.Y..`.QunX.K.....W.<.Z.r^i.."D8.......T.}.."....,Y......A._.(.T...@.....E...9.oKWeL....e.f>Q....#U.O.P3.e..l.l..n.X...L..A%.&..j.SB.\"..U%,.I:.4r.{S}...R..`x..4zh....D.A.".)G...98.2...-.>j&.k....aED.1..C0?.9..W`_...wY...[...d.Gfv.z.<..P...G96.d.......e>?a.?.d..q?..^PC.)h.K.Y..

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_MicrosoftOfficeHub_8wekyb3d8bbwe!Microsoft_MicrosoftOfficeHub.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8169
                                                                                                                                                              Entropy (8bit):7.977841928990509
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:y1k1MFS+q6fuPZgXTFbIv/qOEz8ATIlgivbTCxa+:yVu6YyFb6/huRY/Ca+
                                                                                                                                                              MD5:16531D7723D36F43CA92A8219802DC2F
                                                                                                                                                              SHA1:80761382E37B8A5FB304FDE943D23E0223809DC0
                                                                                                                                                              SHA-256:90CEDDD599076693BD9F8B0D03F19273A4D10AFCF1FF8CCA71F6B13A7090B91A
                                                                                                                                                              SHA-512:84821B6CEAA02520DE115022828900F4672BE16C5F8329F37157E57BDF93D7FE6DFE1D0303F4D9126B0BDC2940153B45FEF6CD05E1A7D2F60CBB8A7087ABE4A9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:5.5<4..P...r.e..4./W...\V....hRp5R.....i......c.6.S..j......g....t..[.b...@...l.hL......p.....B..{.K'T.e.....m5..']M..9.9}.n.....}5)'..D)7``AY....2..K..k..f.VUu.t..n,..PU..9..J.%N._UG>YrQ.>.......0......F.(U.....{~d.Y...[.knj.~.....J..aI.2..G.h.2.*b_y.^.7.Q....2.F.+.><...h=<.....f...]...Q...}.X.OR.}..N..xZk....U...C.R....v.ekR....Z5..B.\...gF).L....S.Z..t...\...O.>.1..........m....._f.m`..nc._...|...o...e.D2.).-......M..L.C%.m.QU.....].Q.Rj..L.Cr....`.*..%.Q^..R..QO,.}.U).....,...S......$.!.yV8*v....R..h....*...%.n..x.p.qp.....i.......-.Q.W..,."g...=`x.f(.NJ.{..9...f.....r..Wh&...M.qZ....diB...q.H..z.......p..<.Ns..P.._QQ.........[&.".d.E.D.\.DL.".\.z....'xW%..Bx......2.d.I........P'..............V.-..k......l.b{n^...;(.A2/_w..y..n...k.%.{*#..........6..YUHF<k.q.?a.............|.....q.R....ZA.....`.}.El.....^.De/..G.z.........e+c..kK..O...T<.....'].....X.....bf`NL.,d...3.u...j.f.....z.p|..j... ..|'6..N.R.h.l....rUp..._..uP.K..^:.k.....W $X

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_MicrosoftSolitaireCollection_8wekyb3d8bbwe!App.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8184
                                                                                                                                                              Entropy (8bit):7.979526493513942
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:B9K6fUKAbFrIJG0vbENQzpPOAPRroKMoXIulVTy4f/qQ2MnIy+:KKAbFkfvbnptxwGl9y4TVT+
                                                                                                                                                              MD5:978F290BF879C8F20E9FBA4573B65CBC
                                                                                                                                                              SHA1:2C44808D0455D5787354D85ED2A52E976F8B246E
                                                                                                                                                              SHA-256:C2147FA4C844B57B3B6EED38774976603858D248DD1ECE785CDD32E7E255F23F
                                                                                                                                                              SHA-512:EE455894FE03DB4503289E705B356DB302F8E162108860D62023C0E15E0F94204D8AFA784EE159585C607CEFD0DF8D18AD30EAF96EA61F600BD0B5D32390B04A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:q...M..,r....(V...kn*.:.......q..i.L...":...Hx.......1+.{`.!.8..<..\.N.!..5...9.$Jw ^w......... .4.ZI[e.q...J...k.....c*.o..JY.W......H.2...U[.ORm.9p-..$.>...C..D.7..Yq..Q..x.....4#..B...Z.....4h....a.U.u.*b8..L\...-z...... .cJ......:<...68V.&.Eme6E)|.z3.._xuo..I.)..|)o.j&y....I...W.n.IH-....0....b.&|a.D.r....M.b..s,.+.>W....f.5.....p...H#.mL..q....Z....6s.7.kJ.....y..y)0...\..4...6o#.U").G|.R...0.......X.H<$1...!.,.BV.m..,W.9..n..7...n......4.E.9T.t!J..ZR....S..6Z%..._....e.:...)..A"<r.GZ.=@..T"..%O.S.`c\1...<..........+=w....p..[...G.(*b8...c...Dza!.........d.c..$....-..tc..)...#...{.Ke...........1 ........rPs$.cZA.cI.o..ztz..$.r.!Gh(s/...{b.d.qfx.R.y.w[.....u.......r.(......>.o.....]HF...MpR....G..w..1rv....q.t...i....5..=.....ri5....W.s...k]...3..~L./...9.....z3...Wh^.y.kaT.P.tT~..C...x^.i.h.^....z......a/n..W..w..g.0f..t.ns..="........8..z....j"W...(!8......i.......8.....u......l.y0.v..@....$..^.P.S?2.,v.......^..4!`...v.o.%wZ

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_MicrosoftStickyNotes_8wekyb3d8bbwe!App.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:OpenPGP Public Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8172
                                                                                                                                                              Entropy (8bit):7.975869696741152
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:WuoYj40bVtpe3zMRco4U/Kln0l+WOYNEnwiySuhywKLrwNl+:W9Yj40bVt2Ur4vRI+WOLPAywNl+
                                                                                                                                                              MD5:B741D2B52029D2ADBF4E4EDE887BBFD9
                                                                                                                                                              SHA1:F73EA50F6505CBED296FD8BD1D0C7A5FDB0CFFA8
                                                                                                                                                              SHA-256:98C6DA8740854F3CA83C61D5834D5CF1EC0441026B26AB2315CD1D570ED946AB
                                                                                                                                                              SHA-512:74E3269EFF968D9009B5A59BC49B6172B5F31894EE3ABE873F1044D77B96DBEF21542D9174086E9D2FFAC2024A91C85CC806BC86152178195FB7D180B7578483
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.._......kLT\...B.q.^..u.'..b..4r..ks.35..i.J..7g....|.>.%..qB.i.n.....[.g.;t.%U......:.y.t....i).%...S.;. .2..wvh.#.M..?...t.9.Z..e..L7..,..3'.....h8...".k...z..v..)..L..R9..g.. 7R.\..].q<:...i.=[=......k.+Y.^O1..&_u.*..$.%....].~....I..r......B.....B7.E...U...,|o......k+w~..#a.be.....L....._.9.!<mK. ...e0..P...-....,v.T.....5.G..k....R.t......N#{r.r.%@.. ..3....A....7.j...,.R[.E.*...f@.H.s..(X.\..r.4..?......Pf.....$.,..".-..9R.S......b.....8.W.B8s9..7..[v........>.3..q...8....1q..SHM.\.hn.....h.f..."g]~..{S.....^..p0.n.?...P.{ZM.....[...T/.....+f..U..Anh..U+D.'.Fs...Qi.VW1.....fQ.%......6.ii.p0.j.....S&'....T.)c3.SnJ..rN.m...}..b.A.rG..!O..z.....{...."0...OUM.,.z..`.<....IE..R.G.z..`...A.d.L&.u>..0P..M.[..r".(.u.Q.....G....e..=..&0..]8n%Y!9..1...)]..*.G.P....wp......o..q.i.....e.A.............y.\..W.X....<.%Z4.F-..B........Dj.......]_=.O.ES?.....j....^..x(...P.I44.'...;w.g....c......*k.z.?.^... .w...82:....R%........%..;.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_MixedReality_Portal_8wekyb3d8bbwe!App.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8181
                                                                                                                                                              Entropy (8bit):7.981588924654779
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:rpU90663Rr/uhFFC7AAHVn7nZzfaHEKvBm6wicoUhwIQmlG+:rpU163ZOC7bV7ndjTBivUhw/mM+
                                                                                                                                                              MD5:5F29D22E93B58FE0CADECA19FB8A9598
                                                                                                                                                              SHA1:DDDA45B863D267332002A14567CF6186BECD39AE
                                                                                                                                                              SHA-256:769FCFFC90491CA79B27DBEFC36DFE55C1A6EB8DC1B41553081A4E66F9881B4C
                                                                                                                                                              SHA-512:E711E0065265979E9C34FCDA7F5A57448F3EE54351C68774A1618096FA7DA91EF17B805850F4F73FCAD86B958593AFE659ED2B6515FB358BE4C5A08F0A738776
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview: ..b6...R.`..;@.f..@..?...Q.vb......s....3.A*Q..;RT7..xg7. t..@x.t.$.....(. ^.5.....s.(....GH..R.G.V..brg=.....xuD..;.G..(..Y....G... .M...!A..mJ.l+o...s......l....).fy&#.B.K...2..../..n{6...Q.Vj....j..y..r....e2.V.KU..1q..._H..oy.9@.u.....8z.P6Z...8.....n#.M.'.%.>....pp.]t..o...$/@K*..SFq.$'..Gn].9......UA.3r.u.\..~1.......[.K..>...k>...S..]..}.6.......wL.D..._.....g....._1Q%k.........c....=U.U.x.<.[-..T9.G..`...x2}...6z,5nF.E*.t...:...u.]%....f%.:.a'z-.=.@"F..K.|m./.a..&............$..M.. ....O6..}.3....[u...N....].(..T9.....&;Y....e...f.Cx2....;S.ue..J..e.b./+_.J....LO....5...g..J.......p.....r]..3,i.A.....A.......(..6..tY..k...............x.\0K`.z......s...A{.b3.o.....&Z5H4"h.....E...Xj_......L.{[GT..@.."G..-..en{#8cPW...BQ.Z....7tq-.G..o.7jO...zQ..:.\mi.0;.R-~xk.&..GrI.Q,.....{..y\...........C...]aJ..i.u..@'...y..Z....s..G..82.Od.mX+A.)....q.w$)g....O.F....r.pmx...S..G.e.(.K.Hs.ZUmX.).)P.O......0......B...}.i.A....?1.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_DATABASECOMPARE_EXE_15.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37289
                                                                                                                                                              Entropy (8bit):7.995840910985746
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:di6VkSUJ3ZZlvndLhNoTOK+Rn4tsG+b1vA4C73rV6NKqIEt33o9WGeROo:goUJHlhhNJKS4r+b5rCkKxEtnodeROo
                                                                                                                                                              MD5:F90A178840355D3073295EC7CCFF6C6E
                                                                                                                                                              SHA1:74A7F5F3D762A43AB0F30C9D10C513EB51478DD4
                                                                                                                                                              SHA-256:EF512B678EA5DCE119640633EA17B12AF694F571C2CA392212D692F8352B2E73
                                                                                                                                                              SHA-512:A9B5A0B2D37CAD623586EBB7DAF6215190AC5F72E41D6B9B9B537CA2160FD353FB327F27E0CBCDBC6BFD1B590D418A6F64FE454E82BAF5CFF472D7CEED14472B
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.....S../._;.....?T.mb..B0.c....Y.r}..6~..;iE1E|..Z.nf..V.9.>.(..s-Q.).+.H"......KqZ.`...R...a.#.X.L.M.`..T......Y...R....Q...&8..J?L..=.Z..O..5.n~A.....R..Xt.....]...X.a. .D_.....$cz..$...{2..I...XE..oh..O..].d...G.V..N..o...........}..c....{..K..c....,}We.}..L.....(..(N.AX. ...k....}.^c..}j\...,Z2......S..2.....6.eF....*.;}/..rq.g..r...W;.!.tv$W..h.o.".nq....b:..k..p...>[h......X....v..*'0.3..3...<U.....>...W.../.Y.f.....=[...^.....a...T.C.}.y..l.....}CQt.Y....Y7.BU..Lt+....(G(.t.....t.y.gU.e..T....^9....K........N.sb.'#.j...E......a..x_.z^...B..8.;...)cWh.>...x..."~..8.._...6#....-.$..p1.j...f..T.uU.dMW..i...p.S#s...'.....Q..~+..L/c4.^.&..Nwl....D+U"v..G.../...i.]..w`Z.6R...`..TC.qh.6J.GeI+..Q...^.q..x..y@._U...:m.G/_]..e..rX.T........i.M=.t*....i...6.Q.p.z.})R)P[........s....4...*=?3N..2.N..}!......Fxc.v...I.@.. .K@.I.=..:.>y....XT.M..`$.I.[.D..s..k"..8C.[..6.[\..0#..[L..+.q)].*.(.w.}v..?....A?K.HKM....".)E....&2N.L....`...;.]..!..

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_EXCEL_EXE_15.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37275
                                                                                                                                                              Entropy (8bit):7.995618988984609
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:l6apMhnMeubwq8/jSt62SCly4Wl642+SgKf6oaEfuIoog8ug:gapMhnMeu8LuQ2ZE4WlAfRwIoWug
                                                                                                                                                              MD5:8F7E9EC0735D6D5DEC77917BB101CFD7
                                                                                                                                                              SHA1:BA8932CD9C22BEE7BD286DB9BF164CEA9FB381DE
                                                                                                                                                              SHA-256:77DADF943B3B572950EFA4132E043B48ABC1B4D6B143B633B0527AED9C56804E
                                                                                                                                                              SHA-512:AB0E3F5FE0C200B53BB61A1F08A7F9670D274163A4E318CFE030C0CABB0F159D2070EBCBE7CBBA9E78A092811D523C625AAB3E1300F419BF30DCEA5F82E8544F
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:IRD..yG.-..`.P~....@C.x...oT.JjN..B+|.y..;.L;....._...MM.|......p..9.!!....M..Fy..l.*P.K.....%.4. .N+TL*Z..Y..pt=?...)'.N....4...iTif..2{..a.V............;..:.........w.8=..u.Z.."..?l.X..q.p.X.W[4.......!.-x..u....4..(..sD,.-N"....sB.....x..N&.".`.<.qp'.. 8.........:.a/I.S.~+.......sv..(......@.,gd}.R.L.....!.l.P...46.+.t ...wp.\.x.Nr.x.].....]..Q.K..z.=.7M.k....vu...~5.....o.ac5.....~.....LXdx..QL1.#..>V.6.2..U....H...m.dG1Y...^....}e....C+O..q.X~#.6.w.......d.f..;r..8.....K..)Q..2.C!.j....[.....ch...:i..*..>{.%.t.oN~...0..ye........c*...<...r(....|qK..._.(..v...{...Cu..V.......*........;...LP.'."yI...{:.t.HD...ZBv.{:JrkO)..l.cyv.4......o_.S..!.....,J...5L..8....sq'.u.a.s_r8.{.H..S..;...&!..j.8I......6...g/.......p:&.s.7Y....Oa..a;@@.+...k..l.v.=<....<]X..3.2'5.M.........7...f.f.&y.#..N..._.V..x......d.....Ah.@.@.=.9.....6.sch3..m.B.....A^..S.s...'t..#...y#..rE.T.q...b.s#...>..jr...I....+..|...........mj.|.....m.!..Q'uo.je..@.rbl....k<..:.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_MSACCESS_EXE_15.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37281
                                                                                                                                                              Entropy (8bit):7.99528224785723
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:5PWJicEIOhEYndD6XOenVXVU66emcVL5DG35ZaVX3Rl9KEqjtl:5PWJifLEShenDD86IJIhlIEqtl
                                                                                                                                                              MD5:1C8F63CB5AC9689637FE67C4F8903F02
                                                                                                                                                              SHA1:ADD38D0938EC732678BD93D420CBAD31D5D10AD0
                                                                                                                                                              SHA-256:B77006099D48332E822ACAF8511690A67C2A863EB1674811F472C48BCE3F7D56
                                                                                                                                                              SHA-512:8F78992FC6F446FFB3F2618745F6C7E75846940BBD870DA250677D8C0A806BF8C96DB55DF871D2170795EB261E5CDB151ABAC7158CFA169BD1500083CBBCC1E4
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..*....V.x..U....'2gT..g..i.../.F|.1-1....e}.2@G.2.\<......C.......t.Rl.v......>....R.....#..(.&...p...c_0...O.....$.8..M.I.z...... ^~^...#%.`8x.?....%k.g.....H....F@....].?...,.N.....U.u.9L5....oj.l....#/.....:..aj......,...N..iA?....q@...Q^....12;......{..@@-.=_.o55iZyw...rsje^J:ZU`.....Ts.#J.2..Z.}.6..8.....A7._...N-{1..f<..G.J1....O...-2.N..#ra2......$..KB5.,...&...x...h..l.6.QE.l`.....`g..?'P...-y...Q...2u.x!:.....(.....8.Sal....gy.tr..3..[...+^..o.....i;..,.yT.{..B.`.S[.h..9...FW}z_.oW.Z./.....N...S/l....O0%.....u.{..h9fI..J.....5...`EA....J........lw...9.....E`J.....TZ?Y....cI.......4t.cq_.).Kv.y...K]...&m.l......D.p.h...z.o|.0.....|..jS.}`....................%...Z.V.1........4:.:..<g.4.J..O.n.:.....G....WI...A7....E...u<.:.:%m...4..|@.A.`....K.Q...)....WI.$.yp...X.....f....Y.+5..F....(....Q.........-..f.E.`.K..D.....v.f7..+[.R...l...W.]..!.v.R._..>..ZfZ.....(.Q.=.m1..;@vQ.......0..E........U.D...a......w.rD...p.G"vR...F ..).

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_MSOUC_EXE_15.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37277
                                                                                                                                                              Entropy (8bit):7.995202816198473
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:TD20W9bXrMZyLs9VSvO1GkU86iEYe5udA94DdtGJOnsIAGmo/xQqa95:TD2d9zrMZMs9VSvODYiEYeYdJzL3nQ5
                                                                                                                                                              MD5:E233C43DB76DF37CBB98B2C2B95A3349
                                                                                                                                                              SHA1:8004AE28B3002666896AD5B0D78C90523177DF48
                                                                                                                                                              SHA-256:6F769F54AFDC01C2DB2A1E3BCDA7B79C9D04B8D3A2EB19C17B16F0601D3DDADA
                                                                                                                                                              SHA-512:5A01C50970FCCDDA8992D58ABA5D6237616D0A24449FF165ACA6A04FEA583B374D1C3B65DF277943C3C27B6995C3E80AAE99F745B88C6900CBD38C1FB7201E1A
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.?_%^.#.5. ..a..;..."Wv>.s..Cq...2p3K....%..E..g...#)=`.....J..R..F.NjI.5..i......!v_..dB.L.S.V....X...s.....wH|Y..L......B..0....:..T9*S....R.ZA.t.,u...z...p.r..h.Z.6;.+k..m|.@.J...k....K....0..'..W4.=~.Y..<./RO.^+F...[7m.F..g.~&.G.Ub..|...N[6...=...$T...FS..}......K.....\...g.({....5..eq.*}7..=..b...U..Z...r'....g*...+T...5........n...<W..i.Vz.....z.....~$....q....T[.e.VNz.2p..?yoS.c.!.M....n.*......'.n/?.;....=.IL.O.#.dg9[.G..06...z.......A..|2M...op.H... ../KTIO..5!8.....6z...[$.t...m.........#Km....)......c.+..y..0..maS.E...T e...?..A.hp.[x).[I.$.u2Rb....u......d:$r.....W4...........5.Y....s'.j...?.L...<,[...!...."....3...t.J..V...'....3/.<.l..h.D...(...Vf.%..|.#I.B.(>.aW.s.......H....*..&....!....o .....C.C.ff.A.4....[............l.i......%.....c8V(.J@r.G....d....c.......zyMeS.+tv.K.g$..l.gv.k.zsn.G.-A.l..m.:...Z.tLn.R.yy...i.a..<...$t...'....?PJ..X....<e..+m.^....a......M..=..D..cu...... ...t..e_6.%k..%K...Q..#.pn.........88...E.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_MSPUB_EXE_15.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37279
                                                                                                                                                              Entropy (8bit):7.994731867969864
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:3+ejlD2lisSIyB6sCMV3yJ/p9BoxYnZ9QWexOdoVgSD4mPq:ZJDUygs73y5pome3moV9UX
                                                                                                                                                              MD5:8CAF86EE1261250641C365C60B1103B3
                                                                                                                                                              SHA1:94A17068022A9B0E9D3D481DDCEA8FF48EABFE69
                                                                                                                                                              SHA-256:09EFE030CA76A2C11B543D63F781B8321E654AA1B48814410AD73F1DD425DC03
                                                                                                                                                              SHA-512:FFCB7B7E07A404E515034BCC8C8E2C67FD0A9195E9ED37C9EFAFD7231FA818EFFDFEC5B9FC600CABD2DBA5ACAD1B2CF5B8911476442A7615C76BC885A31CFD8B
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..]u./.FD:B*..?.s..#'...G..>W.M#.".p.<J.:#.h.*..N..(.=5.w..*f.....5...-V..)xq&..X.k....;O..Y..y..L.;.\.+........\C.......{|..3w..F.Ja.....L!.y.......b.O.65.....4.P@..M....y..BIN..E..dp.;C...f\.6r...u....zu..6Q..<%.gM.aMR.E.&....b..;....EK[.M...(W...(}.n..U...Ej.z.A.!t.y.XAt.="...h..`.u.......7.S./......t.......is..m...._....#.....t(t40....J..Q.....?).=0....f{E..J(7...k%..'w..q.bH... .[.:.....4,.....X.G.%......k...l.6...'E......p..0f........@..m.rr..#....OJL.t.o.o.....:5f<.g.5.>......gc...X..XZ..,..i..+6..R...5.{.....O.|;v...aO.I....9i.T.-.'K.rR.^.;7..3s_..|4).d..eJ..|O.L..\..n..+D\1...C."r|{L..m.;.......+.$.$2..#...N=.pee.l.........,...O..NY.....:..Q.R.d...;e.mt#(...muV..J..gl.)..U.P2y.+....._...Y......."...SJ..-Z...~PuH..*.../H]....,CL.,... ..k.....0L...h..`...@t.Mt0,..'./...>..U)5A..pfz.....$...._.g.._...K..6OAo.lS....{.'2..E..!6.j.0......8w.F..;.][.6+.Z.i....-WxoU9.1.......J..G.J...........u.............q....6.S.A.."..

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_ONENOTE_EXE_15.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37277
                                                                                                                                                              Entropy (8bit):7.994842894816032
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:aWgIJvShX2/Nn6npvUDn/MgKiOMUew7z09MSHC4A3uLSp+IH:ap2V6npsTMgK/bzKMSHC4A3lp+Q
                                                                                                                                                              MD5:F3F598BFCFC182AF58D68C49856D1CA2
                                                                                                                                                              SHA1:A834043577444ABE3E249F6DBFBE483870EBF8A2
                                                                                                                                                              SHA-256:19BF61CCA33D251CDB86E7BFF0F289176A144E9DE93C68691161DE10494E4A94
                                                                                                                                                              SHA-512:4B092C1973C52E47C19AE6ADFF082B70ED19F1FC55C46AB2BD3DA1952611A5B2D3513C288867C2A0825600AE5DAEA8AF95C531160646644DF0FB6D7CFCCF467D
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:GD..f..8v.`..L...\.4K....Hb..44.n..#.. ..@\L.r4.Qz... ...Q8J...].h..S..~..>.......U..Yr(q}i..5S....a...x.].b[..z..3............9.R..f..Z..TV..5Qlt.T6-..at.Y..XN"....>.`S])5...c'..yB|..j._.6$...`.E....k8.{..M.(..>..C.."..".Qo.?..%....]...^h!...]S%4.. .S.x+.....*..".-...9.......=cHtc.#0O d7.D....P..RO.e...%-.....>.B..x...7:vN.....B...F..M R.G.!t........YH.......y..}.-...e..-...}..'.......\..Q..zx}.d}w#.b.{.M..`.ao...;....E^...K..f.....{.-.<.B......~l....QN..:h.~..........S..O[d.....C,.A#.....=G<....:|.....R.J.@.8$.5x.......6./.q|.......~\....j.OXe.p..n.J.oK.N.W..gn.`D%.?G.+..;..).M..O..<..1...(.=EWN............X..|.8....s..L..9FS.!.......%".C...L..@O..U.....h.3.S...H...9z.f..D.....{.._.j..8^.?.e............[.....M..n.@T.....G.)%..v......L<M.}.(.*.].E7..B..:dB..J..L.8U,.}...F.SOG...Q....V.d.[]]@V?....w.....x......j..Z..j....x.}.Uy*...I.h6=..x...N.0a/....&.H{W..E..Y;.7_H.."._S..M.vV.G.......|.....).6.....=,#....../IaO..Z..j.d.>g........A...

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_OUTLOOK_EXE_15.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37280
                                                                                                                                                              Entropy (8bit):7.9948499468868155
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:eo0A/U9FjcbsvzZ2nJMVHqCRZyGftGH6mt/eUeLauE1hlS3D:f/QKywJMVH5SvphSz
                                                                                                                                                              MD5:761B7327E14BC27E5AEC0DCBE5E899B4
                                                                                                                                                              SHA1:CB1E58C7863898B7DFBA19F5E5F1CC68A05D2FFE
                                                                                                                                                              SHA-256:56796A92188673C910C17337E74E969C87DC552D679CD69BB399C0A4906A7C70
                                                                                                                                                              SHA-512:B789003897352F114CFE772E4501219913D077F6F18B910F5BE6BCD5D1BA7427D954C4CF08AE90D700B7F305697A8E8D79DC6204D3796BAFBBEDFB55FF13800E
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:et$.._..*."J...F....<z;9.....K.'..yT......$.WA.i3..5.C..c>....4.@..q...].'#6.).]^..U....P(..c.!e..ARo..cK0....p(..b........%...Z/..\...t%...*p.W........@.f...7.T.}...M'.v+.........i]+..+..H.2.......s.K.y.....Ai..#}.>..L..{.:.5z.....4B.H8%&.....Z/.^...b....v...]%...zs.L.......t!./.T.Op.IE"w.....X.......<Zegg) ..|.'.K.......dw....nu.%'5_.R...6LM.yx..-.?....~?.......{.......1....U.b.0M_~J.%.B .7..Lgw...............{=7...$..E.)._....mmw.5......DCU.3.ps"....@........N...#..S)og.|p..G.....VS.q.Z....m.G.St...qGQ....o..q...8..)m..&.5.hd..L..O.l...a...r..p..g.T...v.....C....~..B.._......._m:.3y..K.,...l..0.>..dh.0n.o...._.@N..l.m ..X...O...{5A.E.....Q<^*x.]Yfx~....e..z1F/..(~.M.........=..Ew*4Y.9...H.O....yA.|...+.:|B.....7``...$Z2.n..0...-k.Q.....-Ka.*-...i:......m...c.H..DK...o.*<......G.....tBH%.&`...A5... ........k..<s..3.....E'.J../Z.J;.HOo.'.4...t.]..c^G."..B..`&Tic....P...0-..$..Tx.v...TVO@.T.......(..s........].U.@O"m;..!.L.M4I..N5..g.v._.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_OcPubMgr_exe_15.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37280
                                                                                                                                                              Entropy (8bit):7.995408657908434
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:Ykh0FvWZJocGz/AOOcp2aGNRHti8WLY/LM433yvVKNRGPMr/WU:Bh0FIycG5UdPNi8533Amh1
                                                                                                                                                              MD5:BD2D7B1A15AD6A0268AF702D650213C0
                                                                                                                                                              SHA1:140AE7A098C3B35DB3210E463B1BBB19C4973D6B
                                                                                                                                                              SHA-256:A5242C8BAC2079F09B79F39A568B5A5D089A7D092409495CFCE1745D10F90D2A
                                                                                                                                                              SHA-512:C706F2CA829B4A1111B1A3D8F4EB613658E63C3FAB941A65B8A35B4DE73CD8F6E3F3954C894805FF1B063AB33C6C59761D90E03576DE5E0365C4622CF33A19E1
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:P...%..*.....1`5!{....wD...(.Ts.-!.....3.#....7..e+...i.... ....j.vFK...m.. E.Wc...p.x.%V%.S........lJlN...4w..u.[$..}Qp. .T7'.0....T5.`.jw.0.{.Ue.Q..'....s...R..r.Z&..E....`..&$M.....|B,N.L\Rf'....yT.c..A..m....V..cNyT...,.=n..>...Q.]F..h..o.3...........l....ds..zg.....D..J.AnM.o...Sy.W,v./I_.7...u.m[G/<pgs.@p...onp....2...L.V..5...Q>lGN..p..1:..."M.r.%x..X..r....~B ....K].At......GQI.....#.....N....,2~4qt..0....-....Xl.[.E.6..c.......]..G.*.....8..pz..]..+.ks...... N...x.E....1.......G.../r.n^$..{............Q...D.1.)5.@.%-#..3A.E\[dU}Z..4X......../...s[..9....?.....l..K1......G.S.QN.F...&..^....O...P..G.`..`.=...H..s..B......u....8{CG..eq.&.B.....Q....#.J..W0..R......5.3..b...e\M...x...,..Z.0.*..<...... .....9m..s0....p.....2.a...wS...7....`....;.+..b#.I...+.7SA.D...y?>.3NHmD...}...l+..,..C..c.N9./2..HQ....E.t@..Z\F...e..}...o...Q*.2..X.|t..1)W.....)....u.7...........+....[..Mvgs.....p^p....a.om.$F-..R..I......d.i.K..A`w.cc.9H.....L...

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_OneNote_8wekyb3d8bbwe!microsoft_onenoteim.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8178
                                                                                                                                                              Entropy (8bit):7.979711646476819
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:Ykd+1R9a1ngU9LLg/JZTGTzirth7b38CdhdbK45Bv+:YkyR9a1gU9fg/JUzirth7bsCFbK4X+
                                                                                                                                                              MD5:2FF157E5CFA2EC936287FD26EDB97BBD
                                                                                                                                                              SHA1:C2645639ADA867832612AB16496415CCFFC0EFFC
                                                                                                                                                              SHA-256:1F05FD6821191972AE9B25D90D2E01C7E91C26C29513F7BA2188F4BD45E21905
                                                                                                                                                              SHA-512:DD4F737FA8221E1CD581E2BAD1D22AC62875A8FCAF4D3CA1EF629B8BB5BDC143349CD2C0D2788F3DB0AC279A3BF8CA95E602A25EE7AC3EF8B43EBF0D05684B5D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:W4nl..d...h*..h...2O..,f.\qm...z%d.MV.?+...L..O..*r.....}.....*6.(X.......&cz..... *...KR.N...C@..d..6...k..r..S(vk.}..]HoS.`.......e...........%....nr.....i...c..%....uV.{J.o....]..J@.M...Y-+.2_...#IT..4....7J.!..i.S>..Y{.... ..#...Fg...!...P.8.9..J...Q_.Z.@[.aS...-.3..g..M.\........M.RE..O:......,.. ....\....Sx.(,...H.q....@9..z.GQ.3.s.*.t..l...oe.2.L.2..jJm+*..-\..e...s!.]U..Z..R..yS.........x..7+..HBa>.'Q_..W.....M.EwY.....\F....=O...'.\.yDh....\NL{.7.(0-uV.....7..G..<..0W......QV.7P..`......w..)...T.........!..i^....0.$O......|...m.lZb..:...}FQ...S.,.z)/s.5-.4...`._........7.1..\..M....W.(o.l..$_.N.w.*Y.K...Y.cc+..Q..V...B.)_SR...F..8.=..E...}A....x.s.....xq....;...a..")..jU.D.$D....a...U.z...........c. ..K..>Y..L...w/. ...T.^..g..R..e3U.M^(Uq.....6n.....D...t.w.tX...AKh.1.R...|..N)._#2z.......LN...9IT.....0K..{... ...>3.y..77.0`K...o*J.L&............5...)........<....=.X...,M.O.p.....PW.......xFT..;...|1.....VN...P-

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_POWERPNT_EXE_15.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37282
                                                                                                                                                              Entropy (8bit):7.995157900078986
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:/8q7y8gSvKrT5zN1aOJQThxfjDUyvvHcXG+e1tmwdlmUrI6X8tyDW1wgfT3:/NPS5zN17JQFJnlXHcXfOcwdl9rI6X8N
                                                                                                                                                              MD5:4AD9463543175900D9C6281CD2C1EEEC
                                                                                                                                                              SHA1:A2A1CF2A035BE588EDC3673A8A56CBD5FB7AB751
                                                                                                                                                              SHA-256:FEDC841B4E17C2E81BD3203FE23CE62DCABCCEF7D502E03285EDA5BD08456BBF
                                                                                                                                                              SHA-512:C0206801DF4F7900C044DF726501EE9E86851002567490E39E6418D8013246259E54369A5669040EF08466001548C95778D5A1199ECE7D62D18BD9462A159E6A
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..7..U.S......O.eB.... ...~..A..3...5...*Q..<?h.8+N..y...y.=.Ji....s...j....X..Vu.x.o.u.'..&.k.N!..?......$..kN..Q...D.W&.UY..Lr....w.c..!R.<.4y....m,R.....lv.Pub..d..Z..-.....:VV...<.(D.vMa.+....k.D.{..FT6-...2t.......i)X6Za.BX..yg7,+.EF...s..|a.[.76...qF-...X1.Z2C..|@.#..pI.4..i.....@jU...#.a,@.......*......u..g..-...]h?.C...z................3..Z9j......Q.!.Q..(+.....t;0][*~T7[.W.=..5\.@^R7....0.[&6C.q.?......3q.kOB...d.6#.i.[.G.t..6.. 4?x.....E....G.8RA.%e.}..6..2.o..7...xr.N...,6%.L.i.I.~.Up...........E.R...M.p..1..n..?)!H.X..b...d...E.'..,_.'......F..T....2.N......5.....2.&xl..74.&..>)...I]....T~..'J..l.>&+.....5K..)+.Q..\......F......u&-.O..6..R.s...\B.UQ.w.. ....&/..F....4A...........].9.....*u...<......l....&.q..^Iv.1.BG.. ..d.(V&."i.....-.?9$.W....V.;7.(&..../E....h.....%6Q'.)o.P(..H..Z...vU..v.W?[@R..2......c...Q....id.......M.4..O$i/.R..uJg..O.0[.*.+.........V.....d.h5.n..[..H....|...9g.P.E.5...i....i.J......Z....Q.\..e.hi.2.H

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37283
                                                                                                                                                              Entropy (8bit):7.995290541789118
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:K82n/rt0uyXMuJFCemjmZNKjfoSfZmhMp50Jo3ZjrA9rDZCvvUK1K8dmUU26Z:K8Et0K64kfSRm+/0JkPOrF2va8ZU2y
                                                                                                                                                              MD5:3C9FB07FA56EEEE2F9A54317ADA8F8E6
                                                                                                                                                              SHA1:3529DBB6C04109D85EE1C13F66D7CE414B12AD6E
                                                                                                                                                              SHA-256:7EDB22B61063E94A2B4745EB00B2CE59E143E2EA04A4745DAED8BFCEC2D4B84D
                                                                                                                                                              SHA-512:271989EF3409B13E1A8E0633C8BCEDF6B3AF23BE0EDC51892D45A93E66E20DFF0B759180F972144A39C2466E882465A325F951DFED6695B4798A8AB6B40786EC
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.I.....q..*O9.ncJ....:.....-.\...SE>...<.F.*a...w..}w...M...$........P.......wrm\.....M79.rh .~.|o.F..1..Q....1./D.l..>..J.R6.......9ac.........?...[.<.8......m|....._..r9..i...z.H...CN..C..&-L...w..5'.X....D.}`7"8.U.Z..........@.%...........!/.0z......k.....xxXU0]....C]E......n.[..7!..`.h9........;.l....shD..Y.|P.=...B0...4V../)....z#......6#.....H0..n7..L.........'..$.?f.C...q.nU....;..}..<Z2q<7b....~......L.h.*hfm"..< ..^...<......D.(5/.ng......]..1......2.1Y{.?E.D.....G.....qn..- ...-S.z.,+.'.r.8.....m.c;.-.RiiIn..XCL.....l.'.........PV.5.h..'.)....\w..4z.E?%..]...!..J./.".o|.N......).zV.W'./....E.,U.j...S"9......P....y.N.l..|......?g;.<...F.i...`..I...LM.k..\.vy.....0d..Qf_.J;.6...1E....}..T..c....@bH...c"Vt.."..j.k....F...9..7...;.m._..wY../b1.Dp.I.2....~.E"....u.....m......<...'...h<.c..q6^.r.y>.`.?`.@....,...,d...._w*....~...IS..S...)...L.G.d....@..\.....@...}....<..}......d...Y@.e...^.K..=A.(...A.@...R....%.D..n......R..$..S.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SPREADSHEETCOMPARE_EXE_15.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37295
                                                                                                                                                              Entropy (8bit):7.994679607587932
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:89ds184hLwmz8bjIX3dG/YVMQAImEUQfWRIKjSte1hEBz4r8:89ds1jOmAbWNkY5mEKIakeP48Q
                                                                                                                                                              MD5:4AB7256407B1711A2DF0F1B8B44C4EEB
                                                                                                                                                              SHA1:F9AB2874D2C3E8D97B3515A5A277D000F7C6ED48
                                                                                                                                                              SHA-256:8E39B68D4C57E30332E8B2B02C5063BC6C2F332C3624328B4EA018F33BBA96BC
                                                                                                                                                              SHA-512:E87431B486CD87A701B93CBE12D17F6F211AAAD11A35202D6E0559A4C334AA679EDE1D95EE7D77DA65D49EF276C3E0E964445DABF2249B7F2C6C41FBBBC5EBA8
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:0K._.o...T.%0.C...n.+.....@iDh...K..#..L...#.2ZO.<.F].hg.A....R....\Fy....?..K.(I..._...n4..s^.[.]..f..kakG.]...<.I...,o.[....v=.;}Z...O....|.)..(..d6...%sMz..3.d...$...<T...8..-.....1..w.J.s.F9........[r....}......xI...8X ....?....Q&.V.%.m..9....O.h.V.S.tGw-@4..._!k..1%.*J.h.....f.Y....5e...g...M..._....,..ei[........e.5........R...D/.L...*..]..2..g.}Md..->.@..!.=...e..o..oG./..*.N..9O.eO..*BM..C.....G|..{...[.......p...Ah.]"^...8F....0.0....-......$Q....T.!d.[..c.?..7M..&B.6...Y.E..PX..[..}.o.v..m..........`b@.XfB!..(..~.d.{..5...u..?%"..v.[}G.I.....:i.4%.q..q...KZqX...F.O6..d42..5..?........E2:L>G...8.M....d;....T..V{.....$*.Z.^%1.V.H.9.[.a....ai.]..z.MZ.E.L.].TH.."..:.ia9.....Q.;9....\.D...R.1....?x.W......v.f0I7-....zF..y.]0.?..C3)..,u.nN..W.x.4.Z.GA.F...E.W..`....|...lkAH...f.......f.]8,.m.\w.....lu..yIk.L.....c.)...Xe.y....3?.....r..3.)6_C.........'.Tn.........J8Q...{a.N....!.....?..1...Z.M....U..w.....y.e....wi..g....-

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_WINWORD_EXE_15.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37281
                                                                                                                                                              Entropy (8bit):7.9954028313119405
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:RGjZhwtlOtPNvBjU86/pxi7Em4mQ5akSNrca/IjnB4+ZdHcAHWZUI1:AZSlU0/pI/4mLBIV4+ZVyj
                                                                                                                                                              MD5:81B789FF600F1754A871E60FB7C058D3
                                                                                                                                                              SHA1:03D7517EE23576B433DDFC2A1FEF23B2420E283B
                                                                                                                                                              SHA-256:907E08841E5B5C5479AE002F2B5DE5121806B9A6BBCF622191D3084DD2D2B281
                                                                                                                                                              SHA-512:37ACE2D674754413688E0268486093741A018E1B819498B03D3F63D5D7686165DF17508BE4158E712F3A0D0C0B18951DBDF798A255B8CBC8858EC87A6E44D989
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..Q.@.kD...].fl. ...QF..NR..z..@.%$..@.|t.=...]..\+..$...0.....<..N...;@l...3..PZ...4.;....qeK*<F4...$......l_p.6`....{...o.H.............E0......K.E..@.9.i.J....=.&..Wz..0D....A6.......J..h...o..k......K.....M...X?a..`}^...._.C\*..TY...Bh...Qd\K~..8....U.,`.&..0@Mj.K. *...Z..s...%.?.......}K7E..s..o.wW1.+..................RW.....t.......[M...&...e..#o.........>../j.!. .....=q.E`......w..V[.9~.|..F...>..S.p..l..v..t....r.....\.B'LK..-.<..RO.j......$.6"....}....9.5;....G....CJ.!x.8.y.p.7^x5XA.m...j.K...m3.+.........D.........h....{.\....^.v...zJD....6I.4....p[X[..0.....aN.o......\.....:...-..f2....9..N..~......#b..S...sY.......b.$.....m$..3......;.....E......,.8..u@.E...z...E.:M.....C..{....g..........B..`.4..b..D.:..>~..e.g..2..8...Y?...Q..|.......$.z..m.U.RA$e!^.HM.T..P.'h.....X....jo.>..S1.t*..RXT.o.#>...K97.j.cy.8C....>.k..1...w..]....^>..(...Q....N....#..*xu*...d....5...r..M.J..C..L..-.y^...<.{....%...{)...eG........Q....=.!.x...l.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_lync_exe_15.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37275
                                                                                                                                                              Entropy (8bit):7.9948391077986845
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:zVJMgb5xjeABvSWfJRpCRtx2HR/cxO6bGXuJM/amjBhMxkStSub:zgg9tzfJRu6Rkk6bGeJcDmia
                                                                                                                                                              MD5:D54BEFC9FCECD7BF0034117D84DC2602
                                                                                                                                                              SHA1:F3B9FEAF8E835FA70521B979C56D299AEA6DA4D7
                                                                                                                                                              SHA-256:1B2321A0ADB1E5304367D2ACB1669F53CC6607B4829B2EFCD4F585F3A943E37C
                                                                                                                                                              SHA-512:437E42B4334EA1B180A8CD86BBA6D21BF3A318B990DDE8E161A0494E72B839103CF32460666D2090B327C052FF1C741BE661ECCAE266FB60323C4511EBD5237E
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:@.%.>...Ux..-&N..B\T.U..gO...}...K |..........{..."F7uC&I.G..@...r...n.%3.&Y.......:wb..P..*...u.......3^.Y....c..H.#.jY%;..!.k.....&V~T..@..........1.I....(...{.V.^..5P...z^).s)c.*Mz'....R.>...<.m.h........a..J.....6.\..x}I.H...i.-..J.v)l.X./.....gb....+....g.M.$T..gu..ZaQ$..x:.."c...I.k1[.....N....d....&.fe..1..D5<.../;Y.).:,N\..../...QQ..}f..>..y....B.y|~..r...L.1..yj..E.nw.eh......:R...U*..pM..l..D.0."Uz.........fd......A....`.bn.*Ab;.?..r*.g8.F.P.aF.*.e.....,....^...W..g...wL.Ba........"..m....6..."..L7...'l.o.5.z)..v....2]../S.+@ ...|I.N4.{.2..."4&...;.Q.(....)......H.yx.....A%....n ..e.y:._t../.|..C.[.....5.....K....P:B.S....q....e.U.;..(..R..I6$.k.l.....y..3_.........d!5..6.2..1]...VV.A..x..7oQ...^....t..!".<a.....;..>)..n7d.9...'=.S-...n9.........3..{17..H.$*e]E+.[..su.-K|.!K.I]..k.k......I....u.......#xT.>]>owl\K?9...*J.`L..7.J\P.....KU#%y."..*..G,..5...b...P.b8.$e...8..P...d0#..D.M9M,.C...2.J.P6......}..u...Y.2.....j...J.i.@..~....d..*..

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_msoev_exe_15.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37274
                                                                                                                                                              Entropy (8bit):7.994752063287236
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:s6HwKo7dSczdv1SqEJdELjOp7cwIk9GZ1m:7SdSSt1SqeOfm7bi1m
                                                                                                                                                              MD5:B3EFA8448F9E7D7DA06DAF45C78C0D8E
                                                                                                                                                              SHA1:D78D880B230D66CD961C9BF597B3B44548D41D29
                                                                                                                                                              SHA-256:C188AAA6A98646654A95F1CF9949B0B3F587335B00A1F123AE1C5D0A2966BDE8
                                                                                                                                                              SHA-512:0B7F06A852E8ED663FACACBF30CD840026A1613C2B193A98A805ABAF0B572B5079DFBD97089C93D07916586C6B69ABA9FCF5E56C26AF9FD05C427C0B40818192
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:S.^.?....r.Y... ...u.{...D.......8..>.p..m..E....8...lu.M...\V../....u.....\.@..A]z<M..%...tn))..1...f...!,D...Oc...MM..V.>a..fJTs.s.8Z*._..u+.(Z?&..K.,q...W*....!J.........~v..?.@.o....#......N.3.ib./....6\....=.....*..s.F...o...../..!k.L....D.G.....v..0..E..E?G.........G.k.......n.&..c.:..9$z.....n.EPp.......Q.~........d........e*.#?J.oq/2...b.@........4.P..6..LX.4..bk.........GR...-........X......c.E<.?.'...V...)[,.L|Y........6!......n.,r....2xmN.....&.H]..W..##,q...=...4".S..:.W..o.}c..X`.&...\6..}..S...7......'...M..F...A..D%o_..................^<....\u..=A.B.X...J.B.....R. ,.&.:.A...N..e..x....?.P......@o..G.I>j....y....F<1.8.S..f..:_.y.R.+}#...#1.........:..N]-........~o....DZ..$.pV2Do~?.,.....r..g.l.L.)$7.........h...i1....dk.HI..D.".a.........t..y.u ..V..1...1.5H......7.........WC..qn.O..t2...t.....*.P...8.[Z.qi.*9....>we.C7..4..a@....8..G..........;pm.#...*..<.zm..,.....n.7 .<.....c%.W}>.0HA.w+.i..l.Tb#.mM|....:."N{.k/

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_People_8wekyb3d8bbwe!x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8210
                                                                                                                                                              Entropy (8bit):7.9773931725387754
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:eOoNy4erCvwqFi7v2K9+TprzOF4zGBMbw/OpQN/F+:eOFtMM7v2mOprXu+
                                                                                                                                                              MD5:714D6F66121080C82BEC0BE031267A09
                                                                                                                                                              SHA1:FF6CB6E6441E6006B590FB176D6ACB43437079D2
                                                                                                                                                              SHA-256:A5B153686B66DAF2316E56569BD8634CCA8006277EB8FDD5F1A818E39AE24A1B
                                                                                                                                                              SHA-512:16A98AA3A121301C7BB9D2E36B4B413CA582C8EA4AA80AFB21050F6308139FF8B6042C4B2CE83A69DA563B6DC1C39068E69C62501FC4FC1231C2D0A0DC98CDB8
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..>3.38[.~..R.`mi.c...V...q.t.q.m.....<]...5......>.. (.....,....s._7..*.....C\...!.........g..+B.J3..h...........D.L...]..b.%....}....#...a6....sr...(X.~.?.E..=.L.\.b".X Vo.._.7..i.0W._o_.=..t:t.q,..{..5wV..{+..%.>P...t.L....'..q....Q...J..J..c.._.>.p..Gu.:}.. ....k.....J^..m...v.j..G.D.R.Z..,(.n.~.vr.?Gf...:^......\3w'g...,..?n....a..-.G..g........<.(u....=.Y?...b.=..0Ba..X......9.p..Gp..7...I...........1.....3...,_%....M..|......+./J....k..Dc0....}......0y^..1I...<..h..........h.I..}6/v.|.../......d,i.....@....}....I....'x...*9........S.s1.t.?B.g.d.%...e...3.F.._#.=r0.I..zP..EeDa.+..../C..9.i. FV..5..6.".. ....j...j....s].......r..1M.....3.q..V.M.(1jK.<.;1.[q\%..)r........(....)..g^..L3..N.Y......!..x....d.o..J.{..t}....%.m.+....;.:..:_.S....K.1..`.s:....3V.)..6.am....z.$P3......_P...$.+....aa2...v.W<{VSdj..(....8...)=....9Z.~z......^_....A.c...P.....EW.K. .W.2.....NA...b.....qe.9.N....C...z.F.&.`Sh.v..UL.Ey. p(5..ml ,m..#.'Dt.<.F...

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_ScreenSketch_8wekyb3d8bbwe!App.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8172
                                                                                                                                                              Entropy (8bit):7.974626065291107
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:HrxMk5otVnTe5dsqztys1G+Cgf2IxE0ZcDJYm5HYy/VnyQnczDaalm/++:HrxPot1e0qhyePZ1mdE/Xaal2++
                                                                                                                                                              MD5:BDE7932512797FE166847F5A0FC94BDB
                                                                                                                                                              SHA1:F0ED07D04B299849CF2DEB37E50DBAD99A0F200E
                                                                                                                                                              SHA-256:0D07BF3F3E31D2D987761709C475681C764445E7B27B88B659AA4EAB42CDA959
                                                                                                                                                              SHA-512:8F13D00BA73FF7553D3A61D5DC78650BA225AFFD29E9675A6147F3BC25C4087D9E1C174C05ED36CBCF82C07648A2B23BEC47108258069F1DCFEED8A8040812B8
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......f...H.1.:..)3.$...vj.h*....}...y..t.4.6g..C.k.|....7..@.kF.9.C.QXQ.v.xH.N..|...A7r...h.VL..3.....*......0..o.2.4y.O.mU.sS..y...}.c..p.S>3.....C.;.Z..5..}..{.\.g...AH6.|.L...I.Z.~xi.C|).....v.`..T.....h......j..6..\_5.o..6d.o...?...s...t..u...6.}^V........Ly`#.gZ.a..bd...e...J..j..xF>B-.P...z5.X..r.......OC.y.,1Z.....(:...-..6.t...G.1....A..Vk....)4`..R......| ..2..%.'Q...&.i..7s.]....,.E...o.HP#.....f.....Q\(..B.8f...Q2.Ft..%&p.NaL.i.0.b..9.....r.Sv.....ar...#.....j.....%..a..'.bQ.&.k...^...-.}#.....?......"..)..x,F...b.....c..r.l..o.....8.o..r.RY6.V....".Ix..)..&9.._.{D1..JY...F.(......K9.P^7...k..M,NA*.S...J.r..op. $...RYD+....N.9........'..;D.c.WL....+%p.5.c...#.........V...!..v.8Jt..BA..up...#..U.. ...1da.o..}sE..f.+s.h...3...l].2.[........NB6B8.r..`.S..[]#..E/c}......t@8.),.-..'..AHZ.P...!.^..Q.z..z..=`x.u.K...l.7..b.{P.T...l....h.).w.. .Z.j....f|.6........C.r2'..M.4..._lw.HT..HEjL......X1<8.\I/.."$.Zz6l..Q...E

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_SkyDrive_Desktop.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37275
                                                                                                                                                              Entropy (8bit):7.994620385575643
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:q2xMnf1QsT38O3ZN4wKCvi0LJ3suPeszIDvqDNmBb+9foVMZ36AGEtv:q2x4fhbBf4wXcaXzPNmBWZKAGEtv
                                                                                                                                                              MD5:3A61232CEDFCF5A116F7AC5BABB524FF
                                                                                                                                                              SHA1:41905FCDC01ADD218BE9A6C9B3603936A89157BB
                                                                                                                                                              SHA-256:780A6BDF33E5B6E5ED18B0C2560F6924BFE07D891A644CC0B7DA4C9054448944
                                                                                                                                                              SHA-512:4A094046041360DB1FC98034D98BE259C94CB5EA1F1442376EF9A62219B66A1926ED23E564A252EEB4464116C01A97955D1EB7B4B54218CE63B1056A6CC559BE
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:....S.Tr.....r....|....s....S.u]...v.-+...0....2]._..?.....%.....t.....Bq..W@.}...%.....Y.ng.?....^8.7J(.V...._..B...If.Q.u.^.....H....A.%.7T.J.h.r...3......r..w..*.......}...".... .....!...r.9!...2."."7..;.-...u|...j[Y.....7.q%..}...`;..]c..(L..6....P1.4!...g......n.O...L.....%....q4w./.......6......h`.......M......1v.v.-.T...o.;..f...=..Py6.`.....AJ..0.2..).02.....f..x=.(...Q.7gId...2.EZ..,.5...V..!.* .$..c...(......+...y..qH.,...'.8(.....|.!......Rj.V.Z.#.........j}...'..0\....f<{0.....Y.q...sK0.K.y....>.. .........7....P+{C$O`.K.D..{fqov.3...t1n......T...[m.k.&..Mh..i.f.IC..yj|.....R....2i:\.6.^.WIz.D.=.F.....i.....'.3oI.<.e...$.#E..C..s5....b.<..>6.y..z.E.xa.@*.....pA.Aw.#6.p.PLf.\..q..Z......Z....Zh.~X.5....._...K..OM..>WBif.".p.....X.".J.GN.{.?p.\.'.....8@e.....4.dt..f..t@*.uQX...*..]..:.3@.!.....*:...h5.'i#.1.8.)._.!Fb....,2a.:Zv.9&.Af.c.9F.ev4.o..*..bW.....k<W.s....{.n.v.z.6..._*.)*]#...UA.U.S..;.r8....kkp.j.G....oc~u...lH

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_SkypeApp_kzf8qxf38zg5c!App.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8168
                                                                                                                                                              Entropy (8bit):7.977020660857973
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:XV8SJOVLaY4049qBUJHor12xTrWCjHCLg+IrVrBbDejsifIMshM2i+:XV8SJOgY40YmALH25IrVd3aYMB+
                                                                                                                                                              MD5:4A2DA79E2F9C3601678E99FE7672EFCA
                                                                                                                                                              SHA1:AFC9562A3DB970949D337A20A555FA64B264BC7B
                                                                                                                                                              SHA-256:17C5EA28286DF051A0502CEC8FE9FB892C2BF26FC54487AD60CE07B756FBEC96
                                                                                                                                                              SHA-512:89A59A899AAF0DC8D2E0229D39F34724B5D50410EB136CD475F8688190FA1BFD424DBC971A89FF2B69B8F8DD44C75E8596B0A3475EEAD7B0A6009C970A034EE2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..P.T.....{^..:6...(...Ilu5I...h.Wu..}b..TU>.v.S.4..hc..i.aj.)by....g.lv.0...".b2h..!..B.....n..w........Sb.@.u..?.k#...+...p....6..(%........qw..}=...M..j"/.-.;.K...........;U.Y...".=./\...7..6.:....R......+0%.P]u.2..%..=a.Y...K&...d..*.F.6Lf...gk\..,.5.j..p<..5.@..A.......f;..A...k..#.....K..K9.P..q%@...H.*Q|.A..K`...m .....OB.#e.o04.X.."....(...y.:..G%-..U...^........Evw.&..u..lZ.jfw...V.A.....m.(.`..*.....`jp#7U...W....@kHP....4a.-YG.J..b....x..l`d..<.3...)b.E..~.5....G)xSXy.>.........E....#f..../{.+.?e1.H.\.g.!..j..Z.*."[...S._A....g...g(.h..W...Q ..(.#....?4L{.......-.$X0A.&..T....K.WD.......}f.T..nesv..O^......{.>i..<%..Lp.|.....9ks....Nwm......Z.+...?.......s...M.7....+.....TV...Z..n.{B|......M<.$kp..M..X..,0..#s<.U.d....e.Cj....|~....;....Q......N....<..%5..T.4.`..u.6......C.|7.|-R..K'..].>.%...P...WS.......7...F@....%...\:..rwarF.=y....{.-.......p......,...2..&l....C..#.c..|..~..$.k..1..X.....S..B.B..l}wqI.L.A... Sm..r..

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_WindowsAlarms_8wekyb3d8bbwe!App.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37293
                                                                                                                                                              Entropy (8bit):7.995144092160595
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:/jjAUb0EZdTBNId/ROKlRQl9NuEcazNXgqRXwZ1HQCK51oUcKRNwO+:bjNb0EZZBNa/4HLTJgqR41wL52UbwO+
                                                                                                                                                              MD5:25E74A8B1A3FFDA16BD220B98C12E57E
                                                                                                                                                              SHA1:ABBE87F4AD7D56D7ABA15C61DF05D65764ABF76F
                                                                                                                                                              SHA-256:352038EB2BCD3F99370E362048209113627CBDFBDCC6C2FEC36B9B6958B496BD
                                                                                                                                                              SHA-512:E29F376DDE142956BAB83DB36CC4C54F5CA56F8CA837DE0CF0A780C260E2AAC419E4B8237E0143026E86F72AE0D04CD1B8574D6850A7A76DC5B8ABB1884AF0EE
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:0..->.t~&`.........#...W..y..n0..h...d.G..ap...[.......T....I...... -..9u{....F..E ....C>...?H.H.L.!.J.U.o~...:>..r...i..*9n0@T.%(...O)$.+........W4G..P@M.......5..y.d.P......X......,g.r......fZ.D.|./..J..#.JB:.6...9....wk..}G..b.....G..u....b...6....O...6.<.l..;.....7..US.<*2lI..x=v..aSbD..*........F.S.......v.~.X}$.{].....-L9X.1)bO...6..;6.._Ab.Da...tPDi.....P.u..\2.j.t....e...QM9w.7./..e..7.`.....Zd.:.....xXxl.%l.C...D...i..u.8..........qY.^._.....9-.y(...I.,....R. .`.(1;_<..N.s4...Dm...p... .......'.Q.A.-a.../......=R.E.!....2..h.;v\....8.......o...v)..U.[..-..!.^zS..I...d......S.)...K..?I..ky.....UU.....h..c$......T.v..}<....G...|<.lz....=o.{........3.G?b..`c|(.T..a.....|...I.=>.......n.s...........|6Z.z\z.X..;.m.J....xt.Q?|{....^..Ryd.g...*d....{X.Q.U".....*..X..z:..u.w.X.._....EXD...2..K.b..xLW.....(.~.?.X.....U?.T..J...G..+.#......1..Xzg...."N.....-....n...c.!..Q3...9.g.M.A...X@i........)E .K...n^J.p/&c...F..D.a..U.......f.*.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_WindowsCalculator_8wekyb3d8bbwe!App.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37300
                                                                                                                                                              Entropy (8bit):7.995520356383001
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:7AaUzfZkq9B3tz8XgJBAy0ptD6u+YGG6HmHA0l3daEu:Ke03tz8EgoLGim5lAEu
                                                                                                                                                              MD5:B3C3A1DE57475562AA4F4725E574BB20
                                                                                                                                                              SHA1:71A9F15570C40C227765A82E5E561433E83F1B28
                                                                                                                                                              SHA-256:185071AA39640E1C0D53671DEB0FDD7814E5A1DFD2B09647575D4F4B5FB143A6
                                                                                                                                                              SHA-512:95196B033571AEFE870C2CD183813EF04D368E40297C5C28CB8935D070389B7CE36B9DC1D89059E46847C896FF7F10BB353398B86899418177A687D2316CC8CC
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.l...k.r.5/...c....r......b..|;.K.$.1..<.E..NjSDO.L.m...{..//%.........l<(/...Q.....S._.).ycD.......Y......\..u..P.ks...._.lX~.3}...*.2....)7u....~...b... 8?P%j_.+..mH.MNa~..R...AE:g.cgj.G..z... .c..kQ...N..............l..u.g..Wf(.JU.g6dI.J...(Y=.=.mS..C[.=.-e.....).....A5....N.{..`....../.....qJ.0I..6.%ta+W...l...f.KQ..6*..6'ai8<uH.$..zL.3.R...oEL|.O.LXE>..d.d.z..Su.(!...h..!..$.4...h..^....L.F..^g..,..6.i...^.p.o.j%...f...Z..!-~.v...F". ....~.s......w.(.........D...*@...<...n.$......U.x..o.e>....D_N..?.k' ......d..>...."..X'.J.....w.NP`...-.l*..;C....#.1\.\.IS..\..........H.....iM.tr......A..<6.5'........|.. z..22..O.X......]....p..p.{...@\'-..(OB...T.9.[o.......*...X..#.Q.'w..k0..f...x|..;..2L..]j"..Z....h.Ql..}`..FX...~.Q(}....q......@.Y......{.~..~....&.v..:>.\?....&;?TPU.O,.j..'.9..@.|!d..U..wO.&X.=-.@AhG.5..6.."..@B".*.GR8R$.V..-....~.82.Z.9..:..9.'w..-...U..A....#(.J...k.;..=....}..\7U.....y..41..Yg.Z.r.GH...a.?i,..,1...g

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_WindowsCamera_8wekyb3d8bbwe!App.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8175
                                                                                                                                                              Entropy (8bit):7.9788529107155055
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:cw8mFL5CI+NDcWeya2RX9Aut9M4LbCtlzj+:s6VC5CWeyHRNAubNb0pj+
                                                                                                                                                              MD5:50F3A79DCE47F9533DD9B23BCD5DDA99
                                                                                                                                                              SHA1:2D6231B2345A2C18CC3FA330DDA501A0DD1958EA
                                                                                                                                                              SHA-256:CC6505A150D98E4E71CD3B842AA389F640500F574A02BA7D3151D5345847E69D
                                                                                                                                                              SHA-512:6E279BEB69D4315EB59FB06607428C631FC0C794DE4E42BD9C6AFDB6441E8312BC861AFC06EE78D0CEAFC0B3D48C2EDD412C6EB8121A8E6C32DCEEC3E61227A8
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:+.ZS.O{K.....B.....V....jysg.....JY.S0Io..|.:l..../..A..SK"..u.A...+1.*.b..x#.}.^.@.I.......: Q...~..;d&...F.......p.o...E]...;Q.kY.kL..9.(.+M..~......>...o.>.....7w.j.{UR.N/..\.....]."..nf..._.\mG...T.}.U.2=.C|,....u&[`. 1. .K,..P...%(..Yp.>p..>.=W..>.Go.j...{.!...,_.s...{.`...f...fp:$.w....0&..Vb..U...f..ko..N.."...+.4S$.0|O.j...~.....f..e.b..(+LgaN..Pv...Z..N.G.A.....n......h<.PC.Rke.._.u.@...Y.........U..S...%...n....Rm.S.b.)Q....w..R....j..........5....<.^...ZD.o.-.........].....i..C.R.'.....k...%.L ...pn.7...(..).|...>.........<#..#e...>X../..0.kc..S0f.V..'..>.k.....H.88....]v..%!)......j....x...I.|....7.p.G.{?$=.v....5.#....U.f%..B@#.z.$.7..U.U.X]Tb?2.y.9......@c.%G"....c.V..T..tw!'.HD.........E.Z..]#.%Q.GiH.V}......].Y}mu......o..JP..c.U+.9.!J.Sc.Vt..V....&..;:..\.......KH?.g..w...W.`."...9.*.....6..O...".....o.M....0.w.N.\.;....2.i...<..Y.!.|X.........N...=.......8.j.U..o.....B...J...7.\...........Lv..oI....v... x..b'|jE.*c(u.&.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_WindowsFeedbackHub_8wekyb3d8bbwe!App.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8180
                                                                                                                                                              Entropy (8bit):7.978139435363367
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:nPGM9LPd6BL1+4nxX4IwDx5xZA2uwQa28Uf+:ndLF6z2TQ6fUf+
                                                                                                                                                              MD5:7C0AD86F885CEB3864666EBFB611DD07
                                                                                                                                                              SHA1:8305C9FD937D28A8BD949308583C3548CD49847F
                                                                                                                                                              SHA-256:B88100CAC224335D6EDDC56DE09221BB148E4823B1DD34E1AC807712C56FE206
                                                                                                                                                              SHA-512:63217EF21D63D7E11A00797880E27FCF094DD9DB36BE3E93FCA7E10DD5464A09B9483CF80E4C60BFAE0A08FE13CBD09CBDA1951FD204ABB4ED5E1814989974B1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.b`a.....of.......h6............o*.Jj.......A..S.c..[;.n.#..NX'.Eb.... ...6...;.r....~...[...n.}}-....N.....3..,.i.Jh.$...y.lT..yP>v....<..o.2vD..r.Z.s... ..?.@...I*[_.E..7.s...k..;..8..D...X......m..S....A.:..5..1>...A.Fr.6K.L$.......#.Z........|@.y..Q~..K[...D..."'.:<.9.7Nf."....f.{....(....t...1....Y.....+^k....O...Rr......}H.j7.;u........SL.S..C...Wk.d...j......k.......r...:...9.-......I..Gc........}..i........t..R....B...L\.V.U.R........og......>:..XdC...,R..r...A...$^./4.....5!.4.M..e,..:.....1|.>0..0..f...3.A|.m$._m..?.u......'....3.&...#E...7.B1-n.k7..2.RG...V.T.[.0.Z.P.R.o.*.G.. .H.0OO.o...........f.."Fb-Z.......M..C-:.q0.`Nk.\Y.L..?.a0`.......rM:..b."u.....I0....E..3..k1..L;.]L.%.h.`...3Q......h....9.p..^...oC4+.v*.....`....d..f04..|-...Jo$$3..-!.p.9..t....@........5..m....](..*\`..e..:S7.0......a.`..!EP.HL.vnk.".6.G...Q+............`..].[.3g.;..i..*`.....i...l....gz....N..!.q.H%....".....E..(.fLU.#Ee...`....\.^."...........V..y.9.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_WindowsMaps_8wekyb3d8bbwe!App.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8172
                                                                                                                                                              Entropy (8bit):7.978010895782763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:pQQO2C8AFRaUFZEbEAPY1WcUwAQ+2ZmH7tKbJBjNW17C6ANKDa+:9MZRvTWEAPY1VUwAQ+wmH7QVBjqC6AN4
                                                                                                                                                              MD5:189056FE719F5621AD34547A94DA2478
                                                                                                                                                              SHA1:2E8F5ADB61E9B6B60B04814220CD8D177BC9A16A
                                                                                                                                                              SHA-256:CE9D474A9ABE836328DA84B39EE91330A4DF75A6E1D5B38CBD2DCB40BD6DFE7D
                                                                                                                                                              SHA-512:999F5105E4B37CDB26654A9EE6EF90B1F8AA7FCBB9039DEB571906E07F44E1C66088A5589DF8F5FA07C7F2B2734F4E250092B89CF741AB7D2591C78E5F08539A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:v:........W)....0..u.?...q.bP........R`dd.+=W...8..3.fT.:*r.t.l.Z.$...FX....]...T+...t.7.bP.aE.(.5....f9K.'..........:V\...e.t.U........./A%1.{.:..J>........}...0B..xN.q....p.HO.{..<~...*.......|.(.-.p....!.X.K.i.Pe.Yx.....c,....H..UI.r...w...6... .....k0.-....?t',.G.x`...i^.1....3.3....Q.kR...<}..c..b.6S..%'...w..j.O.-..t..>....~.(.0..f..A....ua.....q..o..n...a....i.^../.u.%.\ 0m..]...#.CY.^W0.......gv.{.6..S.......w..m.....y.mq6.hl.~t.h3.R? <....u....}x)'G..#[...R...K8c8<..\gp!....0....z^B.r..*....t...wc0Q?.V.vM..g..$...>..P.3H..5F.W.G8'<t........U...Ba.."f..~..:r.{..u_...cQnw.b...B..i..MS...H..o....$.~.......w.lJ)A...,.%K...W..Lw.Ri.....1..I..C6k<.3.V..;...$e...m.B2...D.'.......|c.ZB.....L.Aj...[.]..y..h..".e......8.gI=83...uLI.L.I).e.,..7...6D..........*..d..n.Q.......k...%..n...0.6.`-..-..,...?{..U..\*.HeI......<O.e\..\P......:....Q.k...J..sf......h.K...m.g...V...z4.v.N.D..I.cN!WO ......Nd... i..x....0.K^-.8......m...'

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_WindowsSoundRecorder_8wekyb3d8bbwe!App.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37301
                                                                                                                                                              Entropy (8bit):7.995557841526185
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:h61Y1nCm1uBKLAzln/mUgn6yOet8snzZfj1NT3iXRp5M:h6OCm1kMAp/9gLOetTb2XRp5M
                                                                                                                                                              MD5:E02C0D9E0D81BA04C19144C7EDA8EEB3
                                                                                                                                                              SHA1:5ADB420AA0C15338A8BA753EBEB0915515356E5D
                                                                                                                                                              SHA-256:405DBE9107BD6A9CC5B1C4323A0E51EF407FE4DD4D26041839950CF93A435D3E
                                                                                                                                                              SHA-512:09FBCBE401693580EF08C5B3A21646BA5E7FA9F82C20416B327A62D82A413FF2717C3A79E90409E20F8865DB6C406B96DFA654E1F72DE25C1409E2D5EE12A772
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..B.=j5.X..z-...Z.....zr.a........=.9.....s.OR..<#....`.......[.............0.P..3..P.).p...[....8.}....GJ....{.<.}t._.52.).P)..m....}....Q....Q..+e..s.....(2i#..8z......".a..b]C^..iU...l+w..;..*..9.....[....5...P.....V..#..k.6......d~...!wp..*..w*i..#P,>"ti....t....'y...H...F!...$#u..>.(?j..$.&..`..n.^t.}t...BLo....*q3... ....jo.m.D.d...i...h..........2.W;4}|c.'..3.._...[/.r.Q.2....V.s_.j`f...F..a.%..H.}).I$..\.j.i....NUM.....Q... ...j..._.......%.1...........<...d=.$...^...M....?{..}...9M+.1..6..^..VbL._...X..#.w..&t;.....%.D..M..5eCu.*.B55...tWR%.J!......Q.w.....L:.<...Bn...4.P.{..|Bm.\..V.7.t.FL.<..k....wG..9.(p.Dd....]..*.uk..`d..8.Iy....]13l.a^...P.......+..NZ._M......J=$#.[.>L....|..........iR..4'.i..{......HiW.X..P0.....0..cV},Dfgyt..l......-s.... ..^./..:?dU.. .*.....rt|....*..c...........0;......s..$..W.S.$..b%}D..k.Fz*...&I9......w..#|..[.c... ......i\8m.;.z_A1.&.<)S.=I......DmCH+...IB.&.M.C....Du.s..Tmj......>. ..j

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_WindowsStore_8wekyb3d8bbwe!App.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):31404
                                                                                                                                                              Entropy (8bit):7.994745769784055
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:iX6peppioLK6eWWMfkS/hpEbXTnDolSM6tqkFIKNoSlLXd:5+LKV8VMbXnrs+
                                                                                                                                                              MD5:78BE6EC5116DF974780EB69B7417FCCA
                                                                                                                                                              SHA1:D65D355AB433C01F63C5E13DF7E66E88FB4D5AD1
                                                                                                                                                              SHA-256:A2645660CE610AD74C79F462E8BF51D36BA440FB04213687E26068713F4ECEB0
                                                                                                                                                              SHA-512:679372D2B9EADA6E3A10E0F67BCC3FD6C3827E2780F3A2BAA48DC4CDAB802ACCBF128FF931AF769F094ECF5A51313993B3DA7238C3B8509339F8160397CD93EC
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.../.Q.....5h.6.......*m.k-.....T...J..Fu+..&...}.....}.......#BNCN......3...... ..AG.....Y.Gz.&T..o}.;Q....L.S.o..{...P|...b..$...........i,.V3...I.|M..F#+H6..7\T....hR.j.Aw..........X.C.!..`.......(..8@.........x..A.,..^-K..r..G..~Zv.V.B.@v.].ra...T..T...e.H.*.s.U...;.....BP{#A...I..k.M....p..M..i..Zq..#......N.Y|9'..<.8GV.d....||.U.w....|..by..+h..Xo:.h.&...[..k.....e.........X.....1....{h*...(z.....`...g..j..jjVD.'...*.E..S..nWw.....=..(.H..S{.VwX.... .....p.........@..;=.e..qx..M.M.%qR]..,..0.....T..5.6..(.l.....VM...h.Yb..ox..=.].".r......d#_........NFQ..0i.2v...;N.xA.%.e...X...l.N..-..P].....|..%Ws.....E...{.Lz?........p.X..S.{^K.`..n..x_.o( .n...<..-i..Y..?...z..v.....pqU)"..ccM.o..,.....nL..An.lt....8.l...?..K.6...N.' ...q&e...6(G....(..f....`."...4....6..P.'...&..P.........\K..a....A........t..a..Y_d..0.m.g&Ix.E..!...{..L=............{N......k.Bs=.(..4.......B.;..c~..}...E.-..E..,....."............/.:.......axn\:..V*l...

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_AdministrativeTools.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37286
                                                                                                                                                              Entropy (8bit):7.994975828782996
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:8RPGccjrbySZRd/wRldE7GDfWAuNVa1wxaSUwtpJCIJnojAcjVwpBTWMnI1EClhq:4PFcjrbyid/+LCDNVamJBGRmHTBSrS
                                                                                                                                                              MD5:88C909F7436CBCE9621B4C594DEF782B
                                                                                                                                                              SHA1:DCDB74D47488F84D64B3E3EF849116C3D9A11CAD
                                                                                                                                                              SHA-256:FF2FD05B0BE260C46E8806B8C5120BDAAC4C37BE01D6572128F8BB329EB93FF7
                                                                                                                                                              SHA-512:D14CAC5C56A3554667CAB605AD2E5C2FA0BF25056D1A684CC847DBC8A415E8A31B137AE2D2F96CA1BB25094EF4C959C73D29AA565193A70B9E78CEEBB4022275
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.....}.(V..H..$..Jz@=...*.....J..b1...g....W ..T7........|.$..g..@....9..O.)..N.}k.PM..72./G..|rb.0.a..I.Bwm.x..cC.......".e..h7..d..1...7.M.k...w...4.e....U..L\....7\...=.b.[.#.T.G".wO..ww.f...z......=..k^.V.}N..?D.../..~.|.^....q..&E.m1.....k.m.....!. ........nu..^r..On.=..z:i.iC......5.........5rye.RP..q.?...a7YYc...<.).".>{2..2...=.En.u.JJ..0....Bf(.y.....}P...\..&2....\$>./.e.6..{C3MV..91-1Q..%.2U.}[.. ...H...@.Q..5...\..b63..E.._R7v...L.].\....Q.)+m...w..|...J.6)Q....R:`.]v.td......!.i2........P.(......,...Oy8....6.v..4ga..[..j.\..'..Z>..b.7.;.\1....W.<=...q....I4....2TC.D..nO<.......Mz}....'.6i.;)..A.L.q:=8H".-X..4..../l...P-.G.....F.Mj...K>.V.C. .,...u.........@2!0...g.L...p..6.k`..<...J.b.,m.{.,...TQ.N5s.....;.&.k.....J.!#.........3....1....+..'./...3..d.u..j!Pa5m..0.._w..d..R..qYt.?.{.U i^...q....t...u.NYu(.t....\....I.V..p.%7U.M.R.\;...N?c)....q..v.:5.!1.._......6.DtO.e.u..$[........... Y<y ..).rqc.:-.F...CN8.;........4..-m.6...

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Computer.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37273
                                                                                                                                                              Entropy (8bit):7.995485538491936
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:buznAGYzBgiOrS+xSpJQrvW0ytwAzDjQmX9UQesRYyYBbPGkoG:aznfYV3OrD8JQrYtjzl91eHyWTGkF
                                                                                                                                                              MD5:6E3FEF3FB79659528D35A40ACAC708DF
                                                                                                                                                              SHA1:548FBF3E4E80DB55DC3C4282F12C9D44BEDD334F
                                                                                                                                                              SHA-256:798D4DD9D37520F2052A60AD5DFACD05A8BD2EDBFAEEF2419C6F6F08C2382D38
                                                                                                                                                              SHA-512:B56E7F1CFF6020E9616E43B31C5DC1C0B89A5B8881F4DE049B6DF400EC9370426DADF13128C4672BF6D1B9727693216E2E8A366EB4D4D795BA78AE8C3277D81F
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..k..d..<...P....}..@-.E &H=...<.`B..x...Y\F.F.w.B..^.<..^.@l..U.O.Q.%.t8S(.NP.....".F..4.F.w`...Kp...e...j.X."Vg....>wI...T....PC...XK..I<#...g...g..#B.*.<..`N.qa.:VTs.t....M..(..Q.2w.s.2..TK....LX.-.9da...y...C....w16.G..WY6..Jcp.g..... ........:jm..%S*.(..$9d...A$..7.`...5v.bi!..........*V>E....y..R..s..........fO])..D...,n.R..}..P.r.L`. `....ls(<9.!y....A..AxoK...,O.TJ...l.P.....>.QQ....Q.<....8....!......N...z.... rA.yu.....f|...Y....Ty...L.YL..N.U..v...Lx=p.L....I^F..| ......[... .....6g{].H..F.2.......ch.../..._o..^b..r..Y..Q..h>..zPje.v.n..Z....^U.#t-a..1...&..... 1..r.4.[V.o...>Lk....d.M]..#...c.........2:VB.0.c:i..~{(.V..`..Q:...b.....0.Y..]>p...?i.....P#..f...Wd<rr........N.......pi.S....5.pj...).w..o.A~..f.RF..[.:......%Bn...sL.......u...(......k.:....(.....f7....Q3..ab;.;<n.l..#....a.z...R..=.m1l.DQ.;+@..D....kC..9D...s..TM.&<..HI...NK`.Pt...d!.8..M.?1.........qyX....w.c<._.z.%.........k.......{...3..$m7........S...k....a.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_ControlPanel.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37277
                                                                                                                                                              Entropy (8bit):7.995113574758146
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:MhqMjis45R9jWVVBjpp34Q/ZOYq4AqHGBQ:M0GF45R1ur3f/PqSH5
                                                                                                                                                              MD5:EB33F254345D32CA043FCCC204EDD62B
                                                                                                                                                              SHA1:734E10E99FE243578327496AC4DD488CEB269FC7
                                                                                                                                                              SHA-256:2FCAB2B2685C58BEFD7AF7AA4510E71D97E83C34F01D329C24C889907322AE7B
                                                                                                                                                              SHA-512:9BEA8D5A2C42E4A4B775B96A87A207ED490EF56D7A67834B38C9E8FA658AAFD3369A268D7F92B8F7750420A54D5CF54B6E39109ECE553FDED0671675692B5DF9
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.>.1.Q..}:.#..w.i%..,Y...}.,U.xm. m.....1.B..M....!..{.?P...n....9.L.iz.G)h..@y......0Ca3.......`xK^.....Z...d...>Yu.Ns..\..-+..$`.\..%.q..#.v.k"..Z._.OQ.....w.q...c.t\9|..u.... .L...P...u..e..Z7.. Nrb..;..h?|...K.....]%....|F<.*...!...l.@.Qf.....a.$. .G..6.@.x....t..*.V....LA{.,`..-.u..~,m..m.h[..XL!f...0bp.a.K{...w..G......d..Z.....`........l3...d"..6..`w&.v.....Z..5.[.Q.E..P;..Bh.y..k.{#B..:....#..-.+.6.V..Wf.S.S. h..........].....*=..vWP..')H,0....Mq."...Z7..U[..`..F.;.7..\X...B.C......kn.y.!...oX...n../......Ff..(~CQ@j..\n....k..cL.eo..H+I..P.X...x.[.<...).....x..j..y..7.{...B.9.Y.;...yA6h. M}.....D...y...o7.+.).4.........\...'...]1..E....?..F.KN..z<.O..U.........!..l?.&y.t.....#m.,.=....2..0.L.....@W.2j..0.<...%..9.B..."@h.#.J..3y4.r......7}..........J.*.a5.....F.]....pG6..d7...7.<'`W].Ym ...(?..7.O....$.5..1p.i.nn...Nm.-.,....y..7+@...Px."#............H.[....A.%.0i.....{..6d...N.G.KJ....vY.L......)6cL$.mZ1R.#..y..xO....:.\l..I..Lr.4.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37274
                                                                                                                                                              Entropy (8bit):7.994526774948986
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:fOIu7762rR0W1vNT8jnYUXY5eUJeSi0+Ae4jg5vsVj8kUb0/AoMeCeE:fBu77rb1vtKnrI7JXi0+uYspoJeDE
                                                                                                                                                              MD5:C7B87165CFBC6E1BDDEEAFE4225CB2B2
                                                                                                                                                              SHA1:540859D735D601A084F28E878D1DD5F02B737319
                                                                                                                                                              SHA-256:EC721F902F165E6AB30EFD92D6D9972076CCDDFC2480C348D66839CAFE528704
                                                                                                                                                              SHA-512:5A74B5B2AC4CA95F8DC3BD06039B55105E29B4B242D24B9C2CB8A543ABB56A6200E346AEDAAF4511C7F58CBE5C8859D88700AE5A60EA66B478B54A9A30AEDB84
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.W.&..?P`..l.a.O..S......`..(..g.}...b.,W.T.r\........\.w..V.r`.r.....D+L.~.....l|.....~....dK.M{.?/B..H.......T....?.a...qN.\(k.A.&Itk..yd.('.f.B.O..72.[...b....OUd.....[..2...^.!.V.1.Q.rP.r....G.b.....-.Y..;o.u.9XFS..J.........?u.=.....Ui.T.f.....+...9...I._...."6.>-..cX...K>3..0.t."*5e;.7S...pA...n....0F.h....B.V..k.L.;......45E....;.....L.....o...1.R...:......_...L...Bc.+.En.o.-..~..x.j.........U.}....3.p..6}.C9..%.q5.I&..4VE.YQm..M.>..9f.b..G..O.@U.p....K.X3...A.Oa.....>./.MTy1A.Bb.......8'......P.=...;...B...q.}@.$!1.@...'.~S~...:z.$.p.V...B..<.&.G..}..b.O.....%*t..;~..S.n.?9..A$...kT4t.Q....Q`.._...f.aN.-..Z....6.maB.*..$S..v....z..=.......q..?D.ck...u.!.C.[. ...j9o-.........*.....C"@....._K.`e...f%.@Q...{Onr=.P.,-H..[.=_gho[..../.:gO..Arf..P...?...;N~...e.XV........S`....,%.....<.....=......}./(..yt?9.1.2!..Z..m.A.W..E.......$?nec.p......mQ..:owk.....3..........@.#..D.a.~$e.>A^HV.7...1.3..J..~.>..0].g=.....>>.-.......)N..5..}.B'.bF..

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_MediaPlayer32.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37281
                                                                                                                                                              Entropy (8bit):7.995338406171704
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:5tbTwFlaCruiobn0KjUHlI+k3jyc7iRtY7OIqHHg5o+lx9:Qc0Ln4jL7iR4OKo+lx9
                                                                                                                                                              MD5:3B7B4D695CB4FE3A75A6BE034C15B939
                                                                                                                                                              SHA1:22BA63514988044AA684BF338BDBC811B85565D8
                                                                                                                                                              SHA-256:6370C8EE5D2E6BA72A17432C034DD017B9BF2A19993FB1C960947C4FF295F193
                                                                                                                                                              SHA-512:45E0149F94B5996F03C75FD8CD03B84D5109B733E56F87B78074C1055BA93EEB8DC83BB10FD83092E5B239E3C5317A30942E3393FDDFA1AA186FA6DD23600675
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:c..LA'..u.wy..}.H.u.._.f...1.`...S..a&)"..%.q^u.Xw.ku0...Q.|).l...O...j..%Gb...+s.....g.Sw.v.lT.9+...=G..>um~...$b..Evt"..8V....t....#;.%.r.'....U.^].G....TK~.....j.E;.<.s.2.1T.+cT....7..8e.;..U.eA.x..*'.c...g....5A.8N.c..d......eg..-.....3..5....$.#x.._oJ......;..v..k...{....1..!....,.....l....7...e........s.3..s..T...9...<.].. ...............4q.E...l..ik_.WY..rE..U7@..`.a.z.Kw..^a.G.....qp.r....?....m.U.....Ic.z.h.,nt.q.5Z-4).'.c?X.8...Z...a...6(u.L.#.H.J.R...`.k.1..........SS..*N:j=..c...K=...............".?...%......F...T...1....f1.l.p.u.B...g...t./0*.....sNa}....-.@.}.B..tKv......q.ss.IA....2.E.+.....R*Q.|....Md.M.:......7k0Yl? r.......k..,>..XWE......5.tn.}.z_.Y...(.e..V.+T....N.Ju K.......jP&~.4w.v.....b....1.m...`.....) >x.na.....1J@m.~..44.....9.p.WsBK!......vt._.B}....d}z...v.."....^n.2O...1[..s.$.e5.H.I...vQ..T.}2..Lrt>.....wt.....6>n.6.B....B.Mp&.w..%opm.]|.a.aIj.....9..{e)U...?6....y.*...Y...|..OWZ..._.#..#.,....G.Wy...B .Vv.kB

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Photos_8wekyb3d8bbwe!App.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:OpenPGP Public Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):31407
                                                                                                                                                              Entropy (8bit):7.9939235059066025
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:+mdVsuhZQEWx94n6ZQwNv4R1je1iHYags+UgN4tG3kzXby3cgRn884:+0jPWxDSwZ4LJemZW3cg884
                                                                                                                                                              MD5:05F52903AD4957C07F7E3A25CCDDA720
                                                                                                                                                              SHA1:78CD97B5029ECBAC03840A39579F8CC560FD83FB
                                                                                                                                                              SHA-256:A027B3A9976E7FC07BA63E63E3AE5B682E850B0A9DBE03D413D21BEE539050A0
                                                                                                                                                              SHA-512:201B02AD787143DB0EAA0C94FE9DEA706A8C0CE2283D276F751DC10A1BB32DF20DE12C27D54A3E94A69A8F6FD106DDE072B2A1BAC21C94B84653D12992E0CFE1
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.Az....le.......ZT..5..J\E..N.!.[.>...!..khE.k....8Rz.fD...f5..Z..M..u4yU..mH.w.h....m^..*?G....C..4-._d.gc............?..dC.x.Nx.!..q... .@1.5.k...O..M/...c....IV.i.....;t..5.Ix.,..8k8.......r..^.e...?.............U..r.z..pz"..l.5.._dWk...l.a3......^(.VB.v$.f..J.^.(...>Z>..*dj.......J.'.p..r0-fW.)..s..<?9...P...Y.K.`.$5....:p.....^.Sv.N.~XC...<~...o.O.r...H.K_...|8.,.P...Q.8!Z.%.{.2.h..C.j.UD....+..\z...!....5...+b.....K.>g{..@...6*....O.;..)9D..N6...;v...c....cYA.T.1.u...fP.....N...yp.c.1.Z~...S..;=i.NcD.Q.Lm+7.At.....s}.Qj=.Y.......E.)...(D..8..0.5.....q@PK.t..A.Uo..d........B-.Rd......u...$.p...<...PEDr..~.%.$..Y.`uO.......<L.{{a....(..6.rT....W4N..&<jn`+`B..QV.5...a.# r...7..`"3K*.....w..&C...2....K...)....z.c.(aM..M:.....^P..Y*...V.L;.....j../!..U.. _.d.I45....K.\.T?.z.>.......9..fk.].......$.......W#...4._.p..bS\...<Z.....ZJ~=...t.9.p.{o.E.y~.98....s.....r.\}F.T...z...ii..KL6.5M.+.*..x.....m....`..037>..f.Ic]...m..Fo#...

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_RemoteDesktop.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37281
                                                                                                                                                              Entropy (8bit):7.995078270276179
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:EjNk5zKKV/j/cxgA+9+prY/7JmdTlSlWllLaxIFVSji3Djo5wu:E4hr/egD9irY/dmrDlLaO/sizjo6u
                                                                                                                                                              MD5:E733A6B7BD4000795476A83C743460FF
                                                                                                                                                              SHA1:26E6EBC7269164C19F0FF52F4940E95C5AFF3DFD
                                                                                                                                                              SHA-256:24BFA48020BA43C45C2F4AA70942989346C077DDD4ECAEDD64D40732B0B0A595
                                                                                                                                                              SHA-512:73FBE7F0EBC6CCF83B748F298BF5FECAC303A482D970089AB855D82C6369CBB7A5B739994DE9DB1E8139C77C24DB9030C4A2E74AE45156713D6C353AFD5A318F
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.~c.<....tP.z...I.U4....T.M;.(m.....\&.u.!.r$.u...........,*B...].r..PnL..Si+.<./m....%.F-i.u{..1 ...>.L.d..C...<.SJ.5...4....D:30.7.@......62.g.KN.)..]...<O>Q. .t8YN....._hq<...v...~.._.d<oC..{..g.C..t....Gk...y....LO...K`.J5.../;.y4.x.....];|M+m......9.....l.*.".....<....c=N..<..~..U..!.R....J.K.N....Y..7..\.@&(.@.d.5I...!...............*sQ..e`.{k...!1..q............N......*p@H?@:..d...T...A.}...7~#.".u.n.2.t.....9....q&l.:. ...uB.U..K.ZSB.q..\*b....0..~`48..@j\._.R.....~......;.;.&i..-*%.>.....Le..1..B8....;u..^....$...G..,..`....H....C]..QF.!.O..f.;;1`...Wl.d.b].#z.dh..+Nx*.v.X..?A.|.*..u..T.. 4...(...`.U.G.A...)./.4.k.....S.?3./hZ=.^<..S..!.R.7^.;.._.......:j..o.ac+..z^.}l.4......:%.j.."E6..2...b..|..!9..b.h...x..B....C`....S..b./.~...L.m...1....-.QL>..]~......kr.T7......./vl...zo..e...*.....X...f..J..C.4..b..d`.H.2..]L...+}A6.^r...E..;Q....).....J7..^^..hRc..'..Nzx>.'hx...Z.)tzV5.?.c*).+8..G.U........J*.|l.s$..Y.. c..Q,V..uG.._....

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_SecHealthUI_cw5n1h2txyewy!SecHealthUI.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8180
                                                                                                                                                              Entropy (8bit):7.980634588828616
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:xoEEK7Nn9ax0utbzkRhMB9/odhAcv9T0jWmRUis+:xo3K7Fgx0utbkhMB9/onAcvV0isUv+
                                                                                                                                                              MD5:795AC666EF3AD1DF4E215B9CACF6C32B
                                                                                                                                                              SHA1:131159D0DE0DFACCC15B72117ADAEDA3D628B000
                                                                                                                                                              SHA-256:E6010DA2DD5B8946D7247606AE61AAED639E6CBBDC4C8E08F3A90E142C734C64
                                                                                                                                                              SHA-512:7A953AA3F790CC7187743C06ABFAC69099376BAE29FB82B7DC5E6880136C31D4C2D36E8177BD336E125C7B2BD42A227D5128C612547F21C89F8D0F6CA36AA40F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:0..l..}.d\R)....h..DG.....|..Di.7$K%...KV._p...C.....Y.'.v../I?....4.Z^./t....GS.>.e...||.!.<....7.....c.o.l......../.'...pT..}.."G...,.{.i...%.y.. R..7....=2.......d."...1..R(.v.s.+V.n:d.p..).aI.....;.....#..Y_..N-..7.....@Q.....,...._wp.T.....g.3....B[..W.}... ...?.V.}.T..d{Q:.D.(.".....>Ry..6"..,..3 .....P.R.G.(.....srf.v.**....w.4..v.M/.2.2....5~.'..7.1dB|3.%..X.~M4.ie|...$Y.....7.&$z.x....MaS...eW<.......H.........'o..f.a....|z.uxJ..}...n...X@4..u0...Xu.c%."2...}H..l.x...... ....u........{.jD!....K.ym...?..":.P2j8b.Y...oY.....p..-.+a.1.......6[....t.X....m.............D...r...o..|. ./...X./...K"89........7...|.c..d.{.Q..'.B..3..>.v....|C.6.."..Hf=.`...y.tm...h.z.O.>..K...|..U.e.,&9.c3,.G.....<..K1......]e[./R.>.7....$,a.(\...l..r....X4h.....C.Ln...[@.R..[.....V...M.X....Z.b:Z.Zth.#..A...s..ew..Tl5{...d.N....h...o......5..B.=..@F[..:x.L/.cs..jxB.8>..P..#.@...A0t:v.`Q....U..Z&..k.v(.O....x...X..>{. ..kS-.....e.X..t.W;....G.o.......i.q.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Shell_RunDialog.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37285
                                                                                                                                                              Entropy (8bit):7.994206932180844
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:LLr+CyK+eOiUQTeawVXMQXm5LWrF5bmywGCTTl5E4uWDKobJ78HifDLGBRG:zVXiTQSZmsOLWrF5K7TTnERWDmiPT
                                                                                                                                                              MD5:90A7A8EF84DB785CE576AE9E468CA7A4
                                                                                                                                                              SHA1:0ECD646FF88011FF04A30C1A1F4A168B7F398677
                                                                                                                                                              SHA-256:491D30BDDD84EF971E857A458CC579E737DBE9C0F59881785347F8E6BB3203CA
                                                                                                                                                              SHA-512:9A1B58847AF6450BB398A4226F25B9C8243E837895756A963D4C30C427D89F9E6746C8477D451EEF39103050CD6CD9A31780253E346F23508FF48F076E2B7279
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:...........^ly.H..o..p.V.I.....\t.Z......-..W.k..Z.....s.5.......|e_.$.;./...Pf....u...r...Y\...=6.$.,x.+^.w...v...3w....XN~...Q.RV..sCI.._....U".....[v..;..s....jT=L..).!...9k..$.lv.lz...=4..e.<.Y.....X......r h1.7.yM.k..3..}Os.......e:{....?...-..f..(.<.O...}...[..BQ^Aca:...=.U.&....3V..?.7p:@.....K...?..=.a.U..h.7s.....6..e.......g.g...k....6d(..Q.....#.[...~..s$.xb..n..~.zr...P..6).q<5...`.]...du....6.......X.H...&.4..cN...d.`../$.I.......-Sa.c....h...t.:........D.$A@8.....~x...:=eX...!.........H..........A....5..m....Py....%.)....q..g..xk.3......=.rw..Y.VL.y...|....K.A....?.|k..$."(/...+p..'ZB.r....;...8....."oCA..P+..S..`.....'$.$`H.f..M...........`..;....F...]%.7K...P...E...C.~....4......8.r..1..;%...2....r. ..JY..0.<>.0...W.L.H.U^L.....v...~,.%lA. .`.J..C..;..)4.".h..*..q.o.s...Ox{..E.Ai.r..6>^!.....k.$.Fz.....p..>.^B.P`rp.........R./i.'....<....].;V7B.._...$....AT.>:..,......d...........M>...b......./.MMj....Z.p..aT.%.O

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_XboxApp_8wekyb3d8bbwe!Microsoft_XboxApp.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8168
                                                                                                                                                              Entropy (8bit):7.977060588481967
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:DZ8N5gHSOfk53s2FToxusYWrfv+E0zVWz+TAH9o9As+b1p9+:D+uSUooIsYWjezVWz+Tg9oWJB+
                                                                                                                                                              MD5:52EBD95DC4793827D5B80AE858324839
                                                                                                                                                              SHA1:CCCB06D5828CAD24B34DFB0C9CE4D7D2F393DAF0
                                                                                                                                                              SHA-256:691087A45BB1B56FFDAC641B6DBE4D175F647D6FC5F92E2F40C4D355CB1C8A04
                                                                                                                                                              SHA-512:50D3B5683A1CAEC357D1B3C6436D3E4D7BBF25CAEA3EDD06D317E49F3258DAEFE30AA2A67D59FABF99F2A9A868AF0C5EBE8ABA07213C68E8E1BD8131A97B6CAB
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.t.>.QG.!:~.....w...D.+...O{a.(U.B.G.......%..<w..e.K.U.'.5./.~......t<./.ff....xpsy.y..&..3..!.`.....s....uF..|..Z....m........apv....|...G....I.wV.-..."pG[.zB.:...|.3..i.>.=]...:...4.).7$....s..Y....&.K.>).<....6...Cf...;.5.}.T.A.....r..O...:b....&.4h. OB.A..>...p.c.a.K.z..,X...M...<Y........}6Tz..0...D.{....... .9s..B....-........a8:UQ>......0Z.].......Qm...-..5xW#.....:.^cgA..wF....5.....%n:. `T.cO<%../..b%g.|u.M.t..r..0..x.(.Cb.`..u..Sk=z.....G.I.uP...}FJ....!}F8.c.._......D.p%`..1:.A....&.G.p7.a.O.M_..T@k....$C...e.F..r.n...0.v&T:....b.S..m3..~.3}.T3......Wd......p..J.pfF.kV.1?Ez3.L~2a......?..R...5..p.VI.._\ I.c....?EB.Qf.....}.7..2....jw\.U_..N.zpA.>.....'.&...A.cf.+Q...`v(....R...k...0..~./2.d.(`v.%.wDSy.!z.I..O......5 .<....^1?.Ty.D...y..K?...U..w....X.Hv......~.)..bkj8$..{..Q{/Q.......d....$.x.$.....A..c.S@.Y....KU..S{Q&~.B......:..V...07..'..M.i.l..%#.Ts/.R.AGN.6.{.e.........r.A$J8]d..5..T...<&.:.....1...*u.V....l.g..n.;.F....~..

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_XboxGamingOverlay_8wekyb3d8bbwe!App.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8183
                                                                                                                                                              Entropy (8bit):7.975942364154984
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:MIHTGFZSK9jwH2ZZzSsCxTvvMATV22VPL2ajY+:PG9O8PCdvvvx19k+
                                                                                                                                                              MD5:F9763FF1D0BD90915DB6C39A481FDD92
                                                                                                                                                              SHA1:934BDC3C1C48B4EE4EB7B19D4C1661FFDF6D9AA8
                                                                                                                                                              SHA-256:5EE40670BE266F6F2C38B2CD085E65609CB90752092D24BB1AA206FEC74D23C0
                                                                                                                                                              SHA-512:FE8301D5F52B6FA9C433EBAB47E4237190A35300C46EBDC969A01B5AEE5BFE88F901813477B4223C5F897A792F206A2F091F9AB176F749249B46F3D83EB41032
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.(.d....I......1..._.../..k.)..P.../.#G_Cm!..V.^Y.7/2T..!Hqn..m.*.`3.....{.@.vS.kVO U.8.......F.j$LXX.g.uj...w;%..sr.x...Ct0...McJ.....MF..Ye..\..=..~..3}YKW...!9.b..)....ys.c.2.[.C/.TI.d.=0.|r.B....Dc.jeg.2.(.,I..(.Cl..-......5.o.2..0..3...b...9.]Tg#.....J....t;8fDe......q.?+.\K!\(...$h.H..P.I3xth.)e,..!...Ko...{u..>.w.."".}5.X.r;.k..j.....BPm..b...V...};H.E.u..nq....jx.z&X.......~}.&.....t0.....)......E%.lX{q&.C4.Rv.j..0F...K}2...jB.Is5D.{.....{..)..F.<Q.....e..E6...=P8...4..t...^5~..y.Z....uS...'g....*.k.,......l.Sq{.4..G..P.p'k.~u.m.q.U....=].....|.-*..\...y.{...y.}+nqk~.y.%..^.B>...1..i#eR_.:.Y.=...^.........*w.........rJ5.........y...9..R.s(#..!F..#].oqQ..5...b.x.e:..L..&..........U.&.y......2..+.........2.b.:..B....Q+.!.....M....)...Tm6...r..;d.{2).M....y.j.9>:..!lv....j..V.......8...z.o...[.W...[.';.1...@..iW.C.....w...c..O..@!6.c2/b]..%$.!......q.b&...@:).2...Q..5...p..d..-.IC5.B....y.b.1..8...+*.x?..-.$b.#.D.V".__&.q.\.9..(

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_YourPhone_8wekyb3d8bbwe!App.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8170
                                                                                                                                                              Entropy (8bit):7.9788075731019905
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:ttA+p7K8wwDrJ8fvUCbJ8quJHMXAGnpO53e7kA0P+:nA+pG8wKrJ8UCl8aDp23yk3+
                                                                                                                                                              MD5:A5CAE86749534D8A9CAF713A72B5410C
                                                                                                                                                              SHA1:2399DFD41353EC2BEE06EEE26C2E14E1C1635403
                                                                                                                                                              SHA-256:D66E6AF6F3D2D78129D0DE98D0AA75A2D452C171F15F3605EE7CE5E56A83D333
                                                                                                                                                              SHA-512:C55E8090AFFAA7AC1EEF6696028F77B1F502168ABEAE2E72A820398855001758F6BFA0742D2576F9C8E57B80C19C0B3CED98D87B6D84BFD3F0765FBA89911CE2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.4....9D.H..k^8+ul.j.."W.g.u.U....p7P>kN6....6.|...SP.z...A.......pv./...../.... . .H..86~...[.I.......%J\....n[.j.....%g(eF'......tl.!......+.'..g.\G.0=.,.1.......m/...ya.....2:>...|1@qB...q..Z&..N./......*....;..&.?.`...G.5.....J..W....R.D.l..v.w.R..df+3(..."..."P=.{...K.........z....Ba..Q.Y...o.MH+*l.}...*S..EO.&....o.Y......sJ8U...J($..|.3..T.Ao.9s...tGK.d$..Q..I"..ko.8^..1o..!.................L..Yo...ve.2.i.*7.*h"..S..N.^..E..9..M.?..W....cH..-?...{......_.ZS..r.j..;Zd...S..a.4.j...GM%Z.....*(Q.]y....ze,.j9.K(X........Q<[...m.g6 Ej3.g<c.5j.y{B..Z(a=h..&.|...q7.oD;2..~....."M..<5..o.2eB..u.?..[..!.......a...3..!.....;.I(..?n7k.q.Z...T.q8......C..QN..N.."bDo..D...4.v=...Cld....).@.#*....NUp...)....g.WS..@j/.M......`..qm....4.x.....~.Xp....@.g+.OK.7..CJ?._J=p...\,.e..cB.r.4.....a.9......l7[J00..u>l+...X.i...e~<?:.v..6......H....C.W..x<.b:RD.;A..!IR.(.8pE.6..4..I...y....+mR....5.t].mA4\{.....]..^..J.=).#.~7.....B...0...XdwG.....Je..yZ0

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_ZuneMusic_8wekyb3d8bbwe!Microsoft_ZuneMusic.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8170
                                                                                                                                                              Entropy (8bit):7.978407793751007
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:1DQ+Izk85tShfaYQo6wteo6vL5Ht4BKnLnJIMerrqBSYO7MwDsi+:1DQ+yt4haoltehdHtjbMXMwDsi+
                                                                                                                                                              MD5:DFF6E5F25A199CBEAE0F62E6B5C153D4
                                                                                                                                                              SHA1:82B03299139090882D56820AD6797D5CCB461638
                                                                                                                                                              SHA-256:EC2F227552420EDDF7B423BFDEBD24B28F3CA1D4E6A48B689DAF9C5058D57385
                                                                                                                                                              SHA-512:4AACAC5C79025A149CE39F18A4F6AD542E8271F1A08AD7FF16667B9880E0ED156FFD452E53E5140E5942D90705F50379B2EDF8CDED1A08344734485642219E9E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:E.?i.K..L;.....^.d?.[#F.[...iZ...M.....F..AEb...y...p./.'n..F...Ck.O.....1|M..z.c._Y../..C...`3.S...'.F.C...;..g...^...?.......\.c..e]........V.GG"............Kh...S...s...........%'J..... .n..'...`.,vB..I8 ...#X*.r....=...S..........j..S...q....L.).....IE...o.V.7.K.e..H.5...@.G'.....p....]....;$*~[G..).b.hj....].7.=...S........9....+......x....!....jj^9..BI...zHl.7.,p...GY....V.x=P..I f.eb..o=.A.,...._..l..M.:>!...h...8...||(..2..V`<m...aC.K_...V%v2....1......f..lk.... ].h..4.WG.....v.b.k...US.!3..#.-.....)..^mr...m~.F1......xsT.#K .T.......I.{A.....1.'...E.........j...{..R.%,.;......`s...<1.&.C...} ...i.O.!!..kY.EN.....\`.r..r..../x.<...l`.R....%...h....h..E....6.....1.5......_l..Fe$x>E(d.c..#mM.........\/,-..pG.\B0.P 6O....9.....p\..g..>.~!...Q..9gr3d....D[.T...5....).^....:V.+M.9v.W. ..........B.Zf..-.q.Gt.>.6.fD.<,ltk.M.....8J..K."4.x....i.V..)8U.e..~.dF.f..../...}..+F..LC..d...!..P.)..*.. ...e....z..+....O:.z2.4...

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_ZuneVideo_8wekyb3d8bbwe!Microsoft_ZuneVideo.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8170
                                                                                                                                                              Entropy (8bit):7.977187544131201
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:5DYicK8rJirp/z+xEKRHXyj8bE67hFqrzUskzCY2lGaJ/5+:5DYicK5t/zXKRE8FlF0ozN2lGO+
                                                                                                                                                              MD5:818397EF4385650C3BF0710668CCA3FE
                                                                                                                                                              SHA1:7316FA36C5733BEDE0E98AEB670B5284B97BC281
                                                                                                                                                              SHA-256:337029A0D7CED13F3C129A37BB3DB66EE2CFAF93B18B292CC3135B52F4418B88
                                                                                                                                                              SHA-512:7A28FDE08216A1960A80A168D0A1E5E83EBAB7240B136650AB7F27A6FF5AC4229B36D9605936F4DE365413F3CDFFEF78EE4CD165F0B09B41451C93F886564C64
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.l.U...........jO.3......*..7.0.NN..4k...._.J`.....{.2.fO...j..~.,....E.......4.Ir.Q.41XD..n...Z..1..~!gl...*#/!J8l..e2l...)..:../.C.V..........@-.F.>m..."h..^....... ^f..lM.*..n...n$7...v0....r7..DZ.....j.A....&.%......~.veS..p..|.,X......+_.@.']...>2.v..0l.{.....4.N=.|..Y.3`...r...z..+....Z?nN......A..Wi.}..D.+.....X.w.Nb..I.hN...L%...V....D.DySz.n'.h..xi..#Ni........zxu.U.w.0a9...O..o...?7..J.v...L...d......,.(.2,.TA/B!...qE.K"'....lN.Jd......Q.-f.e.h|.%.....r...`?.A.s#.).L...$ ..a..4N...T...I..2..p.c.`..$...]..E.r_.R.^...t`+?Z..L`'h.c.{.g.KiZ........(G......h9Gu.j.\....~.+..m.+..{.40.rE.jv..T..Z..C.....cHU.+..r...3F..".x8.(j.....Z......j..kD..P[r.7qAP.b.l..c....../.../..K..cv...l.....c.*k.vS..A......q....!U..P6.+]...)\ib.bo.y....h..V.B..Ks6GH.oyV...5.UI._...rl.9X......p.U-....@....w9R1..,.A.....}....N.:...`........M.r..M ......a.......w.ke{...w\....\y..]..}.....S5...3x.=5.e%y.3....)..W.Y..{."l.....nY..CZ.U/8..!.~.._..+*....._>..

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\https___java_com_.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37258
                                                                                                                                                              Entropy (8bit):7.994878914064396
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:OJ3ZNVdRBbU85IxxFXFCqgbLizquzE2UGK/3DB7AhL/xYQj4dy:OJ3/hBgAIx8PbL8LYLtD6rYa
                                                                                                                                                              MD5:CC736C9B5257170FC128F7C65B5F1499
                                                                                                                                                              SHA1:170A5BEBD94AEB11BCD35A7726255EFBDF3F0649
                                                                                                                                                              SHA-256:7BFBC54F3CF7B47C6F617A9607640D5925D0A4C965889999898E4BB505463AFD
                                                                                                                                                              SHA-512:B9FC01F65AB2D645E0CC6B9424500E4E5AF5C8951F1E636A2E8E7B78E04C3651854BFE442FC51962B2556B1B3717EDA13F08E5A0A2A9B3E6D9FF235DC525124E
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.C.p].,;._|B.b.....IZ=%....RV.X.....z.....U..yY.x.Uf....!.....e.%f.t9Gy........}..N.Z...l?.-._.GQ...>...%..5...j.I*...h#.`.HSD.d...H..,.(..>.z.b!..../....... j....x...zq..C..r....Z....N)W.\..J.!2.o...Lsz.z#^1../.@\0..o......U....0Fmf.j.E.V.m\&8.q.f2...^._.|...8!.../..r..)..c5..n..v..w.A..0..+./g.}.........L...Jy.[E.q..A.z.[I.>....BXY...:.U..FEw#.l$...........?...~.Qs.E{)I.....[.{|.V...Q{y..S.l..NG.C.h,&........q._.?..yR......6...T..d`...7zs........O..K.d.C.$..KAB...b..|..r..mv}".....h..r.l`......M..dD..;:.%..p....>].q..}-R2..n.....k......0...B].o.r0X.k..e....zM:.}......t.".1.}#..E'k..x!..6....kx........X..?I>>H.Y.:h..Z........*v.G#.r.Y..."./.H...V.^/....gf..b.X..%..`.ez..).5..6.....@N.1p!.....A..n..6..3.{(...o......{...NQ@..H..Z....s+L...Y..m6?\:....W,..Z...I..E......=...f..\).j....A...g...... ..d...-........t...|...;....{Aw..IH..*4..7...v.jE.#.......6.X:.7>.........&.. 9.9.<.y..b.H..Z.v........i.[....|..N...Gsp...6.Z..:....f.xH....

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\https___java_com_help.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37263
                                                                                                                                                              Entropy (8bit):7.995132949481985
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:EjF3V8NYSM4jf5ZdgoDddtsWhuFCk/aSqknJXAXSJL4lwDD+8cyPm29K+:y5SNVLyuuFoSqknJXA8L4+28ccmmp
                                                                                                                                                              MD5:DCD7CC5723D56F5AF980A7FCCA7F435E
                                                                                                                                                              SHA1:AE6B9E71EEB68609A6C5E230FBEFE84E5B9ACCB0
                                                                                                                                                              SHA-256:468946318579D094041DCA9537B440ED28EEEC0426245FC9209E8FF98F38EF70
                                                                                                                                                              SHA-512:7158994DAF289826761F6CEE2A22331F49583F5CD231ECA978B05FE022990CA21C2CBF6F9732C50BC0FA68D81B26CEBE2630F1A31DFB61293CD1493004DE01DC
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:P...O.>.6.:....+Q.j.J' .7?.j.L3..6.^..L..H..k..t.......$1.na..;..........=.....o..D.....=....yC..<.)e..p3zp=p7.......[<.j...`P'KX...O3.. 'p..0.+....y...`"r:T.R"..MU,S.....b...^.l.j;...Z......L..,......&?i....n.%B....(....r..+B0S...'..B/..".o.y#.X....5.w.R.....F.....c..\.|D...\.;.|D.r'+.!7-.9=.A1.oeD.....D'..yM....w....u......S..o..,.|.j|.wue.zoA..tJ.......;.`x.U.-*.+..'.."...7.75....B..^.j........c..UG-^.....b.T.I%.......\..F.q...,..6.l...I98....e.b...a....m.@.1?....q...0gi%..f.....>....+.K.fw..)$..v...&..$..zp..$....rl.9gv.)..9..".M4J.\.z.....6r.Kgv,A..hT...M..x.....5.@&..E.W..L.".K..../..2>....(@>.17....%.~.[...;......T..Z.,...`O8..;t..-y....|..0..d.....?...VV..DV..:.R.r^... :.....'.H~.]NG5.....0."..zkt.....D........@z>?...........~..RB.+..+...p.z .......l.M.%-...<!^.[y.H.X....%...j<>~.....%....|.s.....>...1.~.`.[k......H.y.q...c...h.n.Ul...T.!...V...f.B&$.s8w.....zJ......r..&&....RS.M%.Ap.........,Am@..4l.u.y.M..d...O...M..<:...

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\microsoft_windowscommunicationsapps_8wekyb3d8bbwe!microsoft_windowslive_calendar.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8200
                                                                                                                                                              Entropy (8bit):7.9778588194416935
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:7uUzNdpPeiFeXUS2k4iYNvFjktPxQF7NKunHJgTfBEel+:qUHpPUkS2eMFjkupSfBRl+
                                                                                                                                                              MD5:205354E87CDB8E4BAFF8C4DCDEE4F2A5
                                                                                                                                                              SHA1:4136E315D8F80D27ADFE67F0A80723053BBD6EAB
                                                                                                                                                              SHA-256:B64E0FA2C591DD00E5548287705A7255FEE3CA7D5BAF91E8E44C326CFC90F3C4
                                                                                                                                                              SHA-512:3B809AE03D1E56729C396E524AA9281F37700044B38F103C2F6C85DA4355ADD762CE7EBE73D627A6A7828B192748CB319151E67846B3D5AB85D7F5E5B6CADEDC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.i$...h..Z8..a...Q..F...Y.).,Fo.w. {`.e4...;.QY..C..Z9...r|.y$.F6J....&..u.]x.....o..M.+...u.3..L.q.......+.gO.Q[..n.Q)....Ng...$...d.[.a.w.o.1..g...=n&.*.+.P...[..........sK.&.0...~...jC..t.a...%....!....IR..`.=\&2#^:..%...6LH.{v..-7~).<?.3....nJ..*..,.......z.......a...{..J`..K....>.\I..1.B...k...Z[.?.........'..Y.,../;.........y<@....<.v.^..\|..h.v.|..n....[.a..c;.H.!?......b.....G..<.........[.[J.J.6....[Z`...=6....BE.j8.m.R.<q.U...;.YZP..6.=@...,..J.jQ.....$l.Q8N....?..J"L*.<.ILF.7...Ao..6-.dBb./F.cfy...IZe....Md._w..7N.l.2W..'M..O..(....8...&.9./).m{.N...Yx.1.T..r...R.u.....).^+V..H (Ee`;....[."qb.W5.Y...D.|.u.g.^...s.%.<6.6S...*6^@....Q..=...,.......zVz.....j...N.6...I.:.).5..-.4.....qJ..[<@d.4...Z..$.........C....k.....K..3.#D.<......G[..e@....p...-...wR...~.J...^.nC..rO...H.e8..j.8.......j.f$..]..|..55..T.W]......S..>.c.xs^....+{+..W..+...j...`.X..$.8..l..D.=......d.2.dK)4..2.....;.M.f....{...9+.r.....l......nb..rB$.\d..m

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\microsoft_windowscommunicationsapps_8wekyb3d8bbwe!microsoft_windowslive_mail.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8196
                                                                                                                                                              Entropy (8bit):7.979669269398391
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:bYR152pMLKK+4GNAv+Dw0C5WZxFJaX/BMetN4o3bSmdIGAxo+:bYRDXL9GKvN5WZxFJaX+ONFP+
                                                                                                                                                              MD5:1409CA91024B1341831DB40E4BE52E68
                                                                                                                                                              SHA1:71FCBCF9FD269AE481F8B8326641FFA42146D93C
                                                                                                                                                              SHA-256:C04515C112012BC9E2E85B770F63E8FD3F92F29C53ABB74C1C511DC73F3DE6D7
                                                                                                                                                              SHA-512:F21DA54377AFFA79A76BF5BA6CF842488518584F359D1E4F58E7065CC9913F6062DF41A25616E3A08E98F1172A8E8C7A490DE4208F1DAF01921C21774CDEB420
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....q....%.U..K.s:|..3......N....*....+.j..\=S.ka....a.....8A...Mt...R..zBb.&.......`#.X_..6D.:..^.0.g,Q.....aX0.@..1P......8...}.V ...J#Z...I..............Ia.$Cj...F....1.....g..rr]#u.AX.X.(....):1.N.#.F.^.....W^.[.tQ..Px.Y....zH.(=.9[.W.W?.h....(}...x....gf.M5...........JF.2.ix.^\..........:......PhL.?9s..Q..c....g.C.k.O..h......T .....n<.`.fS.>`wK..7.Z..R..'.MzU..V..[.....k~w./.grT...r..o-..Uz..J(....&.O4V....[.....U...l../....g..'.8.....+5...z<...L..=...EAh.|.......6.I./...+N.T.......S|...t.rhG...&|..O.TN..'.$..X.j../\UHy.|.\x8._o.....~..S.....<....O..(.U0..Q]#f..B......#..x.._D..;.0.{9Y....a%.p...'..>1W.#....,3.N....3.....@.v..7..JQNXQkk...G..t.|..]S'..2..1".e....G.D.q.......-.I,Z.)...%y..Z.x.N./..qD.1..x3.'......>..T.b"..,.a"....W(w1J..A...].QT.On...d....L|.,v.2!.*@.J.{...D..X...g.K.@..s.d....>.#..ov}.g...H..............}..N.#!|n.:T.<...{^_7!..J.Ae........^..P...._o\..\a..5|#......L..^....!.......QW.3..{.;...RQ.}$R..Q[..C

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\windows_immersivecontrolpanel_cw5n1h2txyewy!microsoft_windows_immersivecontrolpanel.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):7.979092864793288
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:vGcyHGd8ZyMIDt0DeWjGeUBq7cVZXzvG6oaESkekS+:jyHG8yMIRAjkFncaE7S+
                                                                                                                                                              MD5:B9E126D025B0DAC4FA425272730E9B0C
                                                                                                                                                              SHA1:7AC1A70862E5288F445D6A43D9AAD39505CD3B11
                                                                                                                                                              SHA-256:B7A94CCEB229897795CBA12FEFF90A9FC32F4567FC0679A6B2233833844AE9A4
                                                                                                                                                              SHA-512:91EF831057FAFDA6F2591011CAE369203E028D7E7544A9BE81FEC7605268F9613E8CA18160F8B1AA72E231A24928DCEFBE5999050681DAA44334919F2AFA2925
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.%.QwmS.!.D.......rZ.?.)..-_Y.0..CmB.y..u.R..X.9.e..K.x.*khch......;.....$E......z....M...b....^~.}...M=..O.=G.0.z^{LpS..g.x.....?..K{.4&...^..sIq.......-~...&e..}g..x%%.....Vx...../a.$~....x.......GB.8.k...:.)..~i.6F....u..A.x.}.d..*.....^....,...a.q.....LN}.p.E....qvF.z..te.;.l...DZ]..t.Z....Q\..}.g..Drb.*..J.w.|..qJ...... .....HW.R@.f..U..^^../.q+..`...i..pq_..]\..A...~..s..$...u.j.!.......6.x*.Q...m.`.Tc$.W....{...s.!...P.1....+hSRW......w.*........./..p.ul%M..ZE....p1@../..H....aa..z*.......n..N3....4.^W....{5* V......J...Z)H.0...qD!8..O....3..(..]>.K.4/...m.......5..f)9n...Q`@!...tHB.\).ga`}.(.......tK....Ek^.;.L..F?..nA.s..../..].l.._._.t9_.<(.Pqe.c.{M.h.X0..E....Wp"Z(..r.EL...v.>.5.Yb.5E.-.ABP..*M.tG.5c.. ..x.....Y?Z.=.r../<..@jk...rB.]...(.w.?"...3o..IZ.`.P[.!...|.....a.....N..(S...0...,.S.w...'c~x...uS..X.4....\.....w..p..B&]$a%.Rto{o...& ..P.&...u4N..O.x.t........q.{~.0..$...7R..0....?.l.&:.N.V.._..Q..+d....(...9t.P..

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_MdSched_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37300
                                                                                                                                                              Entropy (8bit):7.995522599543992
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:wFznIchylyzd3CumkTJxv+t+lfOf4Y/WUYZuInCJnly:wFzZRzd3CumkTJItve7ZfCJly
                                                                                                                                                              MD5:ED8F7D1B4E18C679F6FBF3ABC0104A4E
                                                                                                                                                              SHA1:12ED68C461031390B0FD606AAC1B4C98D31BEA19
                                                                                                                                                              SHA-256:775246DDCF8473A040EA402A14C1FF4E4F0622040FE759DAC3FC7373305A5EA7
                                                                                                                                                              SHA-512:D4B7ADD8BE940994BFD716271A16C8172EF182857C2C115222BFF5DAEE54F9ECA80C87B109F47DAB2168C53B9CE502DA538F43A3D8E03D152969AF116A6464F5
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:...4... T..b8..Q ......~....Ms}z....9 ..I.|{..........UEf....xv.e8....B..aGM...}.t............._.........}...=.RJ..w.{.Y..h.;.4.`...DD..)......&..#..X_..{...(..9...=.....g.A{&B..8._nrp.:..n..d>.......,.{..w&m.jx]........{...h6..|.a .......I.[&HX..0=p+_...Q..... .N.......j>........q.|v>v.7.{M.)..]W..+..m6...qH......y{*.,$.t`.FO.1O.3...s.L...1)^Ob[..N...N............y..l.!...7..&Z....{4BJ@].X:..T....0d.]../.....%..'....\W0..v.._...}.m.Vi.?.,.v.L...1...^.l_...*.D..j..6n....S.Fs...z.J..u..f.3....gV..8...,sW[...n....+...-.!..i.a.R.k.d.T2[,Y.7...G!=.F.'..i...2..#.....Fm.J$..~..hk&............84'i..q.-.WzF..i.6.RJ...9.N....?.n..(v..Pok?....9|.b..'l.87. .>......a_..@gr.....|*..A.XP.u}..i38z.5E..|.k..>....'sV.eC.){.Y{.P ..{...^..@..:.......'.!...m..P+...D.V.......LV.,...).M.A.+.%C..q.y..:)zK...4OE7V.)}.*6..6?Dr.....?.Y..A..)w..........:.0..,.5...f..L...>....g.=...3....2)......_..L....s..=.a.teLo..b8.ZsVp.*l*a...@.Z..7@.9.16t.[h...`.QM..X....eO .d.8

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_RecoveryDrive_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37306
                                                                                                                                                              Entropy (8bit):7.995323424660662
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:k9XyHjuHbQInufP4PiqqKCPbc4GA4+UAltIiCPy99/HzGULq8YC2:k4HjuHbQVYqXKNbA4vAHIdPyrzDLX2
                                                                                                                                                              MD5:E706AD91941DCDE4DF1670E0D11C62EE
                                                                                                                                                              SHA1:6141B7D6F885FEA035D4FB359572FE4FE4464CE4
                                                                                                                                                              SHA-256:E36512D9818725FCA58C5574A52F64AAB940A4F8A04062B15B53809DF1A60778
                                                                                                                                                              SHA-512:425E757BCA722BE22025E962CE0D00104EE429069A661084A93890628538921BF6262071FFD0CE79DEB185B7BC54A823DD5C66074999700A48D81554D6BDBD26
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:....@.;0.I.T.a.S.}..rZ(...F..A:.V.w...,j6-.$..+.?.W...bGQ...6.......J....g...'3}..!./.P..9/T..v..{.......S.7..tvQm....%vZ.....[.|\:k...#..../.=...$h..n.F...j........{..]..E....\..6.P.....L.[... .....qW?...}t+.......#....`,F..XB._.?...`.....EL.86..LO..y.4.c./...{.....\....C.MF..c.6.s.k .AL.?.?W...}.U..T.....G....q...1.x.M.E8F.).sw..+...A..M.U.^.g..3...@.g.[.....I..&....~4.%...O..C..<A!Xz.........mq..FL!Sz..7.G.......k.f2..+&....KP. .[.X.f.k..?@.H.....#.zI.\...6p.].yK...O.....K.F...$9.....A..n..'."..GOU..yT...,o,...w&%......,q..U.9"~.^...M./z'....95..}N...'..S........J.f.....d.a%......ier......F....h xm8.@h....H.;2.j6B7.u .f;{..%.......2...X.LQ..w.y.R3...i.....=.......DK...Ct.Q...2.M:k#:.M.0..A.S_.*3.D.+.....$u..wW.y?.....w..sjv...)Q...f`...<.^..5.'i.....Y.G...)....P.L......ar5.-.)..vN..c....g.F.P....H\.P......,@D!............ZP.{y...K'...(;...e.....$.rQ..d.@.F..xf.QV..#..(.v.6.C....Xtk..r..>...B[1.+.6.?......+.w.X#.2k...@.._<Z(....

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_SnippingTool_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37307
                                                                                                                                                              Entropy (8bit):7.994226368889468
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:fA2Opoh+camHVISLabjKyprOVym8C+7ucUyH:og+TcVFabfy8wcZ
                                                                                                                                                              MD5:610A583E1C66F0A2C87724A153D68F56
                                                                                                                                                              SHA1:E3C5DC5AB80D6075E9611329AF1CDDDF7A0E29AC
                                                                                                                                                              SHA-256:3CB5A48636866E4323F1FA6B98B3DCE5A7B4D7AF19B0223EA92E00996F2B744C
                                                                                                                                                              SHA-512:2F22523087E38A930D66E37EF2DF0695C4C0429DD70010F3BDD6D27E1693A0D1E43FF9A21CD1755B7BDADA45F9B75E36362B91A92EFFF429EB9A28CF4DA39A7C
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..h..@......x..E .[...D..=..U..w3...d.........../..tz..|.....s.B.+J.a.#......N8).0HD...vF..s&.....F(....).M..O..(}.V.C....P.%.Y....W......]..H<Gi..E.!U;.l....p3.....B....6...X.U.].V..u...-.L.h.....%..9..M!v..R.b..b....9.&g-W....(.Wv..Ci.........^......N.4...a.F...4.fZl.K.Z$e..v...#k^.u.....K....P.$8L..!.N<F.HO....8...'..^..<:..|{.vf....E@.c....q ..Z...N....+......utS'....YN*~xU...?$o..$w...T.R!R.1.:.=..'....dO..z..k..R.}d..a..#....../<....q. ..`..z4.Mh...W.?..6...IC.....V.m.).kY2~..Z..K]=h.3.`k".,\.Z....UmIE.].>...........s.....j).).../0J.{..S..#iO$.|.]..w..D.d5..C.#c.....V...|.[..MHR....b.q'N..9..._bEd..~......P2t...N..7..^.R3(.;...gK....8.q...]jn...PD..A'.....)...b..M...w..W...o.c1.Jz...0...'.8b.eo.K.'......R..".N7....,.J.....Q.....h<..X...&.....J9...Fgg.L.\;F...5+.w.^.p...>.'........t....R.B.t...e.......'v.?o$.....4U...DXj...t......W...6v.ICB.&...c5.7`R...,..$...M_.").s;-u.......<k.c....$e.r\T...L.U/....kG..K5.....D....v.....T.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_WFS_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37294
                                                                                                                                                              Entropy (8bit):7.9944582254488665
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:UJU8htGumtchAvpUWw02UyabBBTScqgBIxrtWCNue/t0L4:UJRtItIAhUlcqg+roo/t0M
                                                                                                                                                              MD5:FC37BD34C97678E0931EA6FFD91B85A1
                                                                                                                                                              SHA1:89490143C2C39CDE852194B01FC57B4F8DD8F5C0
                                                                                                                                                              SHA-256:85295A4F9E68D1F258B245C8BC1C3441BE77B93784738A70DC06D74D30B269C5
                                                                                                                                                              SHA-512:4536D882BB1978B5A7FFF4DAA0AFCA51B9E7620D07C9A039ADCD2C2D7F963A69094BBA1A34608857CCAAF052C88B830342A0F12E5AC895E0386E93ABB2D8DC4F
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:`......p...,..0Z(.+.M..T....!.).q....0..z...sj..........V.........]..Z....k...2Ki..C...........~...7..2..{ ..&...J..Ln.....M..K.c..T..i..d..R.#.....rO.%.'..D..o"'.......Pj.3s...Qg..9.Z...].....bR.h...$BA.b@....~W..h..B....,.b?......m...l.t...J...u?..939.#.\...*..P.U~Q?.S...Qm...oS... ey.s...w..8.....;e.i.-R_rP.7.D)#/.....e.<.-i..p.R.Nz...4!q..R`......F.+.....eJY..5.S.....x..#....~y..i..{.&.,.'.^^.U.T.Z2[G:..;...N.l..8.....r ..../m...e4,......l.x...v...9.Z.3.PFK....9wQ......O.%.9]....Ay..x}... ...6...cr.&.....!...2..<._y/.....(.Iy.9......ys9.9.'..tk......@YL...u...Y........,.....V........eH..p8)V.ECY.~....\..m.[8AY_..8...P?|zB....5.o.jf^..DhV. ]...=...\..I....d7'U.S..o.8k.>.....y.../.u.......H...66...,qY(.>...v.^U_.E}............6.>..\...m...!b.p$=.}..d.Q...t.q..........<mA........n..bX.K.x....K...f...]...c...e.J...;..<..".ie."0.....azwM...C#...E....2.X...n.a#.'V...]...,g.7..#..k..J.jF.k....=...c.B.V.....aO.I.9...1... ...._.pg

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_WF_msc.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37293
                                                                                                                                                              Entropy (8bit):7.9949804618273665
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:iLxfgA/LpFI16JwQoJXXR15kHu2A3Q9Z0Zp3P2qROeg9T7b2BF+Bt:iLxfgATpF1JwZJkH3QAqRtY/WgBt
                                                                                                                                                              MD5:D9ECB78154BFD136A9FC9C2CD076422A
                                                                                                                                                              SHA1:B0E57EEDC7D8B9D3852F97BEE00F025FE52434E2
                                                                                                                                                              SHA-256:91849E7DE205A852D1E32F861742B441E7B066200C1932682A075057F73A10B0
                                                                                                                                                              SHA-512:63CB2C3818C938E77B764861FA22858DB044D09279373F557CC6D881DA0F5AD771035B74243F71E31D1A72AC62D6201C8040C58818D7E37D1F5421F3A3BD0F5F
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:;:.....1/$.O..k{-....i....A.z.U.a.S..Q....6}.Xj.... t).SR.F...".!..qaC.A.%...X.2~0=.....'.0.}....).....~(q..;)8..#y......b:....U.....k.T.V:.........}1.z.f....V...G.....<.......x.l~.7R4..{...."Z...4a.83...m.C.......\=...V..E..Y.!._.....T'L.o..Q.,zy{$..Zo.[.H.qB.....A.....%...Cv.x........nA.F.A.M<m.ta........N....B_...L...i.a,..6fE.;Fk.OT..>...]&...........3..>.=.J.....B.V(M..FY\..^.z.&....%...x.._kY......u..]2..k.u........s..(.5.....l...$..GN...x...h....N..t..z.5+S.....H.pI...=.u...&.q..E.>eG@&..Cs.ha1[......j}/..v3s..*.=.}%4.KI(...-..v....^./.I...fN..Gh..F.....L..+ d....2ao.P..~.\.dd...Q\.(....t3M.)X..o.us'.7..e]?&H....,N.o..6I.U...U..J.Yk...|...d.EN.h.b....E......vp...~..^.g..|...Y....wN.S.5E..JihD8..B@..e. `....__$.&Z..M.[.KKL...r.QX.....q=..q.._.l.HF.AM....8...[.....:.R_~.h........Im..D.)4...e.D........q..1.9.H\\\.O....g...a...6..N].8.Z..f~........M!.az......Y....m*..b.?VR..._..G...1. 8;....?v...PP.....".."...gr.v.....G.D.G.[[n|

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_WindowsPowerShell_v1_0_PowerShell_ISE_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37328
                                                                                                                                                              Entropy (8bit):7.995718096972445
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:DrghlIxUU9JdomlsBqqwo8fB2joD7oXwq1a:D8kDdomuBq1PfBHGx1a
                                                                                                                                                              MD5:775F32E9542D3D04A364CEC0AB12656A
                                                                                                                                                              SHA1:6714130D7BF9DA5CFFE24C0DB9702B570EFDFC97
                                                                                                                                                              SHA-256:7205D9E1612217B58AF92C202F98B8B7728582230DEB04EC997C6FE1B235ABA9
                                                                                                                                                              SHA-512:CEB8189CE8B11CC1F1AC68E26AB822A954FD96C9D3025D9EA0416DFFCF24121304C93F87A73537F66C52B22D0424969D0A400F3208B531CF123F6A69C7767A0C
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:S....xF..0..>.) ...x.5....;{.;n.<...!..EfMY.6..%...8".7i.&.F.W............`5......c..q.ae.f.4...6..=....!...,..im...=...X.m...3W.......j...6P.TB...C.......T.D..a#.......G#..9$....Qx..p.7.Eou.Q.k......0....Fv.r..,.r.'c.w..C...J.c.g.Uwq.vHy9K..A..Ts.d...\kM..G...uIQ~.=._C=.5...M..q...+.{...=.(......@.2..(;..&....3wF'..C=.=.i..M.dLP?;..t.(...c.l..KM..i.E.U.$'..p.....]..^N.ED@.@.)_e.+.8.<.....B..v...E..(......v..ir....S...4.go-.,..2....>.1..g....Ym.._....?..L.q.Rd.dC.].....C.&K..l..<a.....V.K.4..K.....Q..#S..G...p>.@v....\:l..cf.....w..u=.[.t.....s.{...:R&......&.3..EA./..GRG.n..u.a[O....Cu.%..7...w.......L......b....fm..D........C....._.|;...#..p...:,.SL...t....P.s+b..%.59w.~....+.i.z..V....F|.. =.1%.....C..!A.l<.......[?K.F......q..D......J..?vA....9..>o;g..~.."..I.PE...K.>....'.[....oR......[_............c5..1.4....H...bz....Q...?.$.........g.KUO.|Gou..jVS.*..k..V.k..dxS)@Q....|.S[.......5..;.B..'........,.k ....<.0..P.C......

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_WindowsPowerShell_v1_0_powershell_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37327
                                                                                                                                                              Entropy (8bit):7.995529249133276
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:pu0oSmUJQUVcHKSyuhhnd+lLrk6YQk+GqLi5GhsiQCeLSO2Avm3JnZS:I0bmU2UVcH7NzdwvYQ1+5Gh6eAEs
                                                                                                                                                              MD5:A6AE7C01E22E7DCBC54FDE77461324EE
                                                                                                                                                              SHA1:ACD258E0EE76EBB1BD243C99D9AD8BD48CF997AC
                                                                                                                                                              SHA-256:32BADA157FAE8E854FA8F7848F0A7B1D1AD54235D034C918238B3172E9109C3D
                                                                                                                                                              SHA-512:823C5A0F49AEDD7B284E90CC8345F5BBC8218CE3907A62F9182A081F912E8ADAE861C9E60501DAB7F9FBD89E862D771D72C885EFA00B9DF9999524E4590F0377
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.?..ZU.....mP8...n..P..~..m.....\n&..L.3..U&..jDo.H-.Y._.......OL.....gLe....RaE...{.m.9..../..........YL....4S#v......v..NH..= .h..Z.4...Uz...k#..k....`....vM..9.bc.GsD..$...:^p....L96:7....97xs8..2...,...&...C.Q.8+)2R...Nh..U4.y&F....=.U.......;.:z.....UEN..GkcP@.F...Y);O.i.I.B.2.......Y...~"M..>f.M.o....-.e...C)(0.../H.}]'J.......0.:.......K...b..9#....H...If...%T.....C.......7......z\.i%.<{..U.qH$.bp..j.,Z.(.U...e.hX*.h...s..@. .>...|..^.$.e...A.....ZQ..C...(.../...XX{..8s&..*...Q8....R)...:.d...X..G...85.z].vz.RaeN.T...0ya.....Zt..M./......c..d.Pn....f...h`L7t..~e.S......f.....@.v.).W.l......r....O8.7n..F...]..).....3............<s..a..t=o0..~..?:.....m.b.cwU.$.MTP.....Z.6..m>"..78...l..j.....O+>.....w....9..."...>..%......`..L....)....m,uw;%R.4. ...NhI.O...[...P+.gk.ow.|bl....zN.W.f.P.<.i@"sR...k.2.......5e...w....7..!Ic.....OB.2...z....u;.H.........M9...4X..~.X>=.'pI....+..x....../.....8GmM..E^..9w.!.b..P.o...gT4..#.D.....xI.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_charmap_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37300
                                                                                                                                                              Entropy (8bit):7.995024615225392
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:uXFlvKKiMzhO9PXklKvI9b9KzoVoUd9uWY7Do9:uX6KbAPXklKA9paYcWY7Do9
                                                                                                                                                              MD5:13BC6C772FA6915B6C4621AFDB96BB8C
                                                                                                                                                              SHA1:A134E7CA9F8D7E9B00D66FFDFB2C9EE862924545
                                                                                                                                                              SHA-256:FFB156115494CFBB944A92F9F9EE498B3177303975883F02580251262DECBB92
                                                                                                                                                              SHA-512:DEEAFBA1E329018221C9124C6F55D598B05F1FF032619817B15DE38D1E6DD143ADF3DD8C9A619379BC2B651AAB64143269D04A16444C3EA8CD655AB6B5934827
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:....7.K|....*0).........C.!......H.{0.@.f....M.b....]....aF...7.yC...U.9.......g...j....'.V..d.e....V...y.f.......h.i...tC.......k0..$c......k..&iMj.T..@x....*|.}LxF.92..g9.<{...K......i...4..9@4..3be.....vj.....\.....U.:...5..=.2.....biN.....t&...*F.a....E.....%....+.2....:Mm..(....z.ir....f...~.'.....R+..R.z.......;Mu.J.a?..._H...IE.P.P$...s.G-...V../..i.l.S....:.}.7K.+...@...V.u#.d!.......E`.O.#>..p..D..g.]c.QY..6_..N.n....o..m...]..5.zt.Kc.]z.....vF...Q..]...,h6..C..?.."lS.)..._g>..> ph/.._..q...S..kE.o.J.4.W..........Q).o...#d.K.[.I..&.S_.<...*..Kq.....Z.}...W..5....Y8M>J.p..">.n.V..W....E...L..\......>....&wN.i0........%........ .......>..Y....n+.J.:t.QP.T.5QJ..BK.r..&.`..z...>f3<...:..........6-./...........ix+R...1...uJ..,....>.KA.O.Vw.2/..h.._.<.......u........R...#L0.&..f.:cG_.j.....*._...BT......."}<.1..{!O.b...io(.P8..h..%.b...0.....b.]9..{....g..%....v..s.*b+..c|E.JX..;2.(.-...=va.Ts....5.....v..w...T..ZH,0.|.\DAO..;./lZ.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_cleanmgr_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37303
                                                                                                                                                              Entropy (8bit):7.994599355454167
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:OCBN8JHaFYKbYmvkdMyxKRdsLVmJ3S5dNiCk:O2OdKEmvk1KRdWMUd6
                                                                                                                                                              MD5:B6D0AA56AED07497160D6450705610C4
                                                                                                                                                              SHA1:1427BD5425B6C72FCA4C3438F150C42B2517BFA6
                                                                                                                                                              SHA-256:709D5137D461C26A1E5B8175469C8C746514D946E284CA4468E49374CD1CBA23
                                                                                                                                                              SHA-512:9A00636910617F76A89B91F6DE5C54E1CAA98B663496E4A8B5D596397DA163782BD3F1FAE8F8ED415FB9AC3D431036D1BD7DEACC71288F57AFA3C2019A2190C3
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:".....T.C.3.H....Lo:-.n..b....R1....{|.P..^]w7.Y..z{.v.0...<.U.NCa.k[.......o....j..V....&CI-...r..JAN....h.=;...c.em...A...!Z.._........<.L.6y..g....J1..<..U.d.-.hL.0:b..8.@..G..Y...blt9.D.......L.l......oIX....D.{21....i_DI.Q...[U.!.*....a.l.-.{...w...d.e..r4'.n.O.T."..H...AqE.n.t.ij.v;....B..+.p.T..=.F..=d.X..}............D{......_...."..Z....Qv....%..c..I9A...*....4N{..XZ.....5.~)..W.U...9.. 2......}=.v.2.....Z..!P..0..T.6. :..l6JU.<.V=.v.Q.w....+&..`G<5'.i...I.D}Rl..D.....[..%..G.j..a.i!....X...._.8...$.W...9....m.B.......`'.U=....a...>... ...g.O/+;]+.DT.K....../B.U...Q....hN.....%...-%B.a..Di;.....Y....9w......;....om.t.q.2.iD$R.^:. .W.I......ZB...?'.@.........LU.t*..8..O.....T9....LJ...(...^.7L...&.v..<....V_.Qd.$.Q....L...g.....r.3.x.?..}.....JG..6O...=..N..{G.. ._..6>..{0.$.-..b ..6..eW9..i.+.F.......@[T}...y....'.......O7zh[.QzV.M..A.....s..y.^....Gz...../.U`7....K.......?......1..V...)D..k)g.O.<...[H..}u...QAa...1..q...}..RZ...j.;.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_cmd_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37294
                                                                                                                                                              Entropy (8bit):7.994973502514763
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:mjtSKsoDti4tYR0AuwEkeFc/pzzMEjjUoBSVAALzUdOFLANnRHN:m5SKZD8uAutkeszzMQouSSnMLsnRN
                                                                                                                                                              MD5:1BDC1B2BE602CAC19686C62B8DAF7FB1
                                                                                                                                                              SHA1:0D56EFB431FA78F770697799018085454945A240
                                                                                                                                                              SHA-256:10479E8038149806E886519EE95818113E2AE5CC993A8784AA84E7135DD78CB6
                                                                                                                                                              SHA-512:7A42D52F82CF34CB4602A5F436F3571E39A24B989E21FB499FE5B6F40FE10657D5EB246017791D65C5F0E2BA5C2428EDD92CBF670DFC1739FC6856C7C927E4D3
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.....o.Z...*......BH(...\....u..t ..:.[E.ru-....!..../y...,..fX..^.R{%....H.-4M6)..`...~h.j..Q....{c....>...{X.1[H..l...2.[i=..c=...=y......M..+B.E....m.E..wB..uW...!,XG=.O..-....$X7.~.....vk=..=z.}9..O5.....\p...=>..J.:.....w...#....o..\.J...b..u..6>........w.4....t....[ZS.IY]..".....m...4.Z...O...K..."..8...f.V.ju.\....J..-.....1.j....).....O...20%.d......*...i..t.c......q4..d..@k..9......87....'}.2.g.n. ..x.|@-...r...W.6{.Q2.`h....^.P...`3].F....L0,?_....Iw..%..>..U.6K..]NY...gj9.{8........cr.......t.v...=.;U...WY'...4....Y.v.0a7}..y.f.....Z.`.^^..G.q...<.].I. R$.i2@...Pw..!(d.2..|.5...8.,t~.*8Z......y..7.....,._..}....l.)..tY.N5.0......y....2B;...b.-$O.....^_......H..z.,y..%?.&.....a.[...{cy.BL.BJk...&W2..G....(}..{7..9.).....N.%0../fyE..KZ.b..3X.. )...xO*....X...f..%..4.e....'F.(.#Z.Y..g...f..w...r.].L...jv.aK..-..@&L...H`.C..:........WtA.y...#.CA....6:.W9.A.g....%.S.~.E.\2v..7..P"t.9l......k|Q.c...Y.n..((.%./.....^B@...:

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_comexp_msc.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37299
                                                                                                                                                              Entropy (8bit):7.994835505745678
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:MxzRpe9ZcS/Kjr04/i3E7bBq7rqGSMDzfTZwaUzJgjpK+eQ/irVY0:YpqLuxRMuSfTA1upNoVF
                                                                                                                                                              MD5:7E63936A879B6D4386AE699ECC8E20F9
                                                                                                                                                              SHA1:0BE215DD74E9740D87438753F9878959AC9A6A71
                                                                                                                                                              SHA-256:B233B3C00E18A862C76714B998C192435D7C330FF3584F60B19EF5DACF0B8D42
                                                                                                                                                              SHA-512:7B5F1C45FC4386BF624212697082EAD3836471109CE268FE2AC974428CA05E8E45B3DE3680319F0D817F6477F207B3158BAC5AE2301CEADD769202FF5BE3EDF8
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..d-o..............^..;..Q.,q..~.P....z.;.YJ.......\........c.^.^..KN....G.F...O...g....`p..w.hnY..cm@.C\....*q..?p..G.6:#..G>\.m.z}y.jF...q.F.....tO~.+.m.&n]...k..xa\Pn.'O.c.Y..^.f..(@.V'b}....q$...Z!......i.p.)4..O'...?Sn.!q.w...c....X.PJ.6..Z......_/..tgW...b.....k.8.!....p.M0Y...[.. [.vG.>........0...Y.aC ..HuL...E..~H.-Z%d...................B..K....#...q...7.F.X..u.......D.k...wQ!%5.nO.zd...}.=7..'.e...&=.A... .A1...R.G.c.>.....J.+D.tk..@.['...p......^........\.?.b...+.....^.-.\e.=o<....MO...J.Me.=.Y...W....j....5.....;..o../Dm..QE.'.j.]/..UZ.E.c.j.s..5...._g<U`.f.L.......n..3..j`...^P......2...3.....8a...nfE.Z..3..0...a.....8.A....[.%[.wU..w....C.pu;..-C.G1.v...y....>q.g.k.....c.0(%;.......l m......:....4+Q......u\...... .{....K....:X.a.k;.r....i.2gR.....hT...H8...P.&:j....z.k.9;.....]..B...FI....*.E_R....X..p.c..6Q.g.x.9.!z....I.z....u..$..)J.............."D...s.=.[...{HC...t.....U.z.5O..e.._*.Z.t...W.r...0.iV...}"..t..^.Iv...g..lE

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_dfrgui_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37300
                                                                                                                                                              Entropy (8bit):7.994807371299746
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:EYvRrTWbk/s8wQdi8GLMV4f4MZFjchwoV/KtzJ08hrba5+cGsRRyNuw07f:EIRhRd5VU4MZFjchGza8ba5+cG6RXb
                                                                                                                                                              MD5:26362D5D4AFAFABE6DAC801E67DB4FDF
                                                                                                                                                              SHA1:C43CBBD7FD325E27789EBEFA52DF916C833B3986
                                                                                                                                                              SHA-256:4F6EEE9F4B92CC0F4A7049B5AA43E48977C4B4ED9893FA6902BE7DA46FE29DB5
                                                                                                                                                              SHA-512:FB786AD26E7AC6A8739DCB92AD9B74B0EE7A3BD673E9470965CD0A7586665969BFE0B161AB205C66F653A39450DFA9C7FC29E3D13B728660299620E0C6E9CFA2
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:=.K6.Y.I.?Y...s...~..p.Z.+N.C.o......~f)..=.....A...Mf.l......g..Pe....)[J{v..sv..+...1^S.>......`..U.r./..!..@...{.%m..3...q..v.."~. ...~(.!F]wu.......55H...k.=-...... ..2..&..qL....N..l.0..e...w.k...G.........u...k.?%&..-...S..h..}.m...jv:...DJ......d...Q...f#<....r................H......b.:=..D{E..9.bmV..W..>'o.2./.rg^.t`.?.j;.8.....I...3.X......q.........u....n.S......+.._/6..tr...r..Xx.-Cf@.5pa...D....c...g..JH...;.T.........V|...#........o;(..6{ig..J]\...(C..>....*.>}....]X0..Yua.4!..Vy|.C...g.....d..<.RQ..Nw./.,].-U...<......^...<..........V\:&.../......~L..Q....s...U.Bn...=.]_9.......c...HI.}1......7...*[.2......s......O...}\......Tv}.=?I.utJ....*.D#U..&.....[..^..8.].....D\l.Z..b......F%{....a....yB'.@........H~s..H.G._..P..:.s....c...i.8..E..W.w.)....B..y.}qS.v.~..Ew.M...].....7.{Kj3zq.G...G..0.{.7....d.]...t;}...Gbw.....[K!..v....5.us.J.)k.`..9.s.RO./.6..q.....R...7...x#.P2.F...}c.9..k.|T......,..[.7.x..@..#.y4.C.vM..w.B...k.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_iscsicpl_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37301
                                                                                                                                                              Entropy (8bit):7.994181003733086
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:Bv9gj2xdgqQ6ZEgSTrlunSpwhhlK7ptacHkm9BB+4+i/Y:Bv6jK6q0gSHleSpwhuDHkcW45Y
                                                                                                                                                              MD5:8F2F38C61481A9B562A8537CBD80518B
                                                                                                                                                              SHA1:72C3D57DAA99BC863B028BE46C784D28A05DAFD8
                                                                                                                                                              SHA-256:5D78C435CB16B9ED1E88CB537D6FBD2B9B99119439BD711997E6F58BE42DD031
                                                                                                                                                              SHA-512:EB98FFC23ED200F29D266048A42EA7B6DEFB07A22A279127AB7EDAF370B2DF60BD22BC656EDD5B089FE311CC701670DFDCE50045BF48040C1CB6F4907693EBA4
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.O.()....,...m}.....-....$6.C.b.t\x...E......,...7d.#. J..,...........1T'G...A...J.4Ik.w.o....='.^.....K..7...E.hf..:.I..".N=Mhw.;$R1..X.=.[:.{....7....$t..<...b.!J.s.8..V.q....O.e.... rm.<..R1.k~lJ.;..*.].^.8...zy.K.Gg..Q..bmdd..7.:.*........;W9n....0I.i....B..N.I:......"..er..ZvJ......f....I..........#Rt.Y.%.z.V.G..G..N<..e.7.-...E.....L.Gq......G..Us..!...q..%....|..o...7.o{)..1.uIU..D.P.u0.9hx.Q.^w$..f2.m.......I$..@,.H#.....E.....4......^1mjj....Kq.M.....).{..{.....D'w?......+.....\.TM/.p.....Y.Z.2.q....,1.^b......).....1..a.U...]?....L..=.]'..r....C...../?ee...@.../UZ...l'fm).....,......Q7(...>.w......I......r.CsA......8MsA]..<3h..fi..zW0.6m[.../..i...(...:Q8.....]........{............2.<._....I...a.g.!....7.E@..uls..1..}..v...c4..F..j.u........!.-..Q...Iz..F.Ps..[....@...j...D..s...|.#......x ..T.,5~-...gh.Bd.....'.,..s....>.~I.N'.....O.%;..Uj.U..)q.i..q.|.=.x...Qv.I.....1.L.f..@.6VI.S..^H........3.....'..`...>.[}..

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_magnify_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37302
                                                                                                                                                              Entropy (8bit):7.994991410844292
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:rfDI5esi6IdT7GCtRYcxqmeklb1dGvnrwjI7NDzyTZIos10uRB:rLI5esi6IxaCz/nGTGKNi5s1PP
                                                                                                                                                              MD5:078D8BD8D37CEBC9BD1ED22B70C54724
                                                                                                                                                              SHA1:5E4A8F4700608946FC9BA205454A9C7F4C0F8004
                                                                                                                                                              SHA-256:FF695E9FF27C2565966C7B4EA5860AF321D83973E8AE6E024F444B72950A7C7C
                                                                                                                                                              SHA-512:700D7544782F5BDDDC4881D6426CA7320335F3B53369273FFFA8C9A1DA603F54D21B28DD05B515644CE5CC9D08B29B90EFEB117A0C73B573115BFE89CC4247E0
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.......y.."....Fj...&.....V`.nF(.."...<-...g...4..w..g.{... .*...cr.B.kElB...~H..[.q..c...,=.DCr3.Ct.H'.d..p|...d..C.SS...,.._V.6....!W...o.2..A..y.U....}.(..P.B-0NK...j++I.d.H..m.>Yv....&.*.R...5..2..j..Js.....Y.d...Z...[.GK..T.?..D&....Dg.W..t....^.....I..).......6.oe........k.....w.N9T.W7!.TO_.......)....d.E..$...[#^4.....${.....u.f...J..y.I..,Q.]..T.4.el...\z....O..../.. ..V@.a.yh.. p.....!......:GCt........N..= =.~...m..o.Hw..x.e0..w.T.T..:v_... ,.X......."FNV,.H....]...J..D....DH.F7..B...........lM./....P.......F...GF8x..|..(.<.......~..h..../..:..=..`c....(.\.^k....gS.[fI..d..V...h.\..){S...n..k:^....J.V.(...P...H..z.5....K.>....1d+.\.J.N}...uD.....~K .k..}..E..N.'".4Ln:ew..8(.x......Tm(...}..u......*8Q)pU.......v...WZg!....S<....2.....;LL.r...O*B.9.uX.........[.y...._..f.....L.F.....28..#oY].......Ho.`..,i...s.x[6f|.7:.....l......!....J^..p...z.....p...z..%.ik......%.k..*.e..L.0..!X.zOaz=.?..N.m...c..6#.?..Ot. ....

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_msconfig_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37304
                                                                                                                                                              Entropy (8bit):7.99470960010518
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:btut+9JuRob1q90ypsbJdxKG56+psLPbfEz4iL1etgc6ZO:9um1g0y6bJHKGXsg4q1etP6E
                                                                                                                                                              MD5:3F11DF31C2B19B00D76546343A6E44E1
                                                                                                                                                              SHA1:5A0628A045A05863F0C6CE4C6CF23EF45B6610B5
                                                                                                                                                              SHA-256:B9BDE8E1AC07B356AC8E7E87C9A9CDA509FB1279E4CC4D9794C9F6C596C2280C
                                                                                                                                                              SHA-512:C0968E36DB2E6361001D67DF6CB927742CE4D91C9A2EB3E84601009683B5FC1C1FD50F03B5B8D6631D83B324AE845B14A5AA2A06EB5455F289F678237737AE6B
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..W..D.S........$i....9...C=qv.i.8V.:?...$..C.i....v...."..67.....4.N8.....:.<)."~.hlQ..t...{@......a.:@..!...T...).R./..zEvR!6):...........Z....*jhI .<...7.I......,.....0{r8-..9...7..'0&.g.N.lUV.b...6..a...&..O.d..9qd.V..q\.d...uT..p8...N.3O.5..... ...A.........Ro.5P....F...[...p..&.s..o.3.u..`F..r\..>=}Zk...........qi|.@.y.././}..f:5.K.IM..V.A.=$.j.Ldu....@.C.k.&k{....?.^......23.wD..9..IF...b....o.5...D...F.XG.T...].......z..../...%...9....J...,d...E.p.....y."..D.K$~.....Xj......g......I.r0.PU..4.#.+..yZ!C.t.*RW..i..3MDOV.A'x.j....@.X..6.....Z<<{[&E#......T....5.....QHh..O|O.B5.-m..j.....J.......2....z..[\...T..R<_E..-..u..<C..R...#...........t.NI..3...<.M.\b.8...s.j..5.2.v\t/..m0_M...sBVw,..X..r.....S.....HU..5....%].)..S..d .u....`.{..e..(y)..Q...,.z:.z9.l.'......,.../Qx...[..L..H...I..M.rk.y....{..a.3..TQ....w.y..@...K=h......5.A..j.o.jCK.......K....B...?..aD..`j.R...........E......!x..}.J^..[...;)...g8...!..>FY..p0y..}.--v....'...~*{.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_msinfo32_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37303
                                                                                                                                                              Entropy (8bit):7.994332123353223
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:/sioecc6sDJfSBxGLLW3kRN3yp6ygui+V5FQiH/cNpfzKWuCo:EVec3sDJfSr+C0N3yYv8vFQiHS9zKWuF
                                                                                                                                                              MD5:25EBBEECE6BF0F15DD65477BCD19934C
                                                                                                                                                              SHA1:B035A908B2DA0E3BF5BF40C29CE055D85BDF9939
                                                                                                                                                              SHA-256:28BF269BFD03BCA9ACD57AAE66DFD6D5322DC7CFFA3F3193E554F8B06587D057
                                                                                                                                                              SHA-512:C86DC60A33E1F802DCC7F60DBF9A863CB0203B118C8189BAB39B92BC54E0623559F2F799090AFCB9D9951EA891EAE7EA61A07FADD1676850C313022C7727D8B7
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:Ab.....s..........Q.W......'&..2..1qwk...P..YI.].}.......|.+.......z..3.\e.h..cXw....&f.:...9...u>....K...l1{.N.F....B..i.,...X...........0%=K.Us.]...S.i.m..2.l.......fR>Z..9.qw.T. z.......vH..........L.K*G.I.e@:..'.Y.4u......9.M../..h..T...*..$.......t.v......H.([.D.K.@...&.ut..M........@.k.s6;ak(..y&.[@P...v..Z.>...p.k..p.2h......s..._,..D..\S.z.t..7ig/.P..xky.......J!.-.%.\.#.2|.....EPN3KUW..}.4.>...K.o.[B..0Y..1V.._.......=>..}2...yX.`...c..@......y.....6....8O\...W...%.....](j.......@.|\>f...<..<...\I ...$Z.........m;"{?../..!..Y~..^.x..:.&...xjH..B.....I.....ER....p.4}D.QTK..P.r.c..N...}..{..+U.....4q.5..p.......$L.G.D.3w.C,..i.C1.8D...Z.....X[..l.....}.qA.t...A.y.<..'Gz...[9..d.KD}.....f.T...J=z..,(.?..=!,...V8.....S.q._.FS..U......HDL]!.3.3.r..?IA.....M.......*.F/...@........B.u9&...P.r..._..7..qe...03~.N*cD.P...I.t....8B+..m.Z.J....9l._}<.`...h..U.t.L..mMNh.#....i..._.v...a.q7'm...4.(..=OiL.Vv.w@.:.1......U..9...#.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_mspaint_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37302
                                                                                                                                                              Entropy (8bit):7.995332851647249
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:XmsZcH/hze+NbDatA/1luYZiSSFLsCYF8cDjOJSEtR/raWJAX/:Xm+wh9bDagbRuLeF8cHOJtXjB4
                                                                                                                                                              MD5:F6CA0A55B11D782F79D473786DC426C1
                                                                                                                                                              SHA1:904C17654F811592E13EE654DB94A47B0BCBC9EB
                                                                                                                                                              SHA-256:695354C0487D205A5CB1E90FEFCEEA16D18184FA55053BEE34E8E8384172D011
                                                                                                                                                              SHA-512:04C652AA6C658911F2B4AF7355674E9C37F0A13D84F70DBFAA315A8FD01402C0579FC780F3260C581917447FC34FFFC87FD45D9C679FBDFE68D3E6D3613D5BAE
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:r.M..~.-A....2..F.....*.........U'Y...er.d....'.!...'.y...3d.G...O%.y...l/..,#/k....-M.:....sp$..C.S2.k..A.'V.e..M..p1v....."...nA.uz...T.m...G.L{v.t........`D,B....v2...9A....q.R..N.qE1...Rl...XM?.F..fr..%....AM7...v2...@...i.....bm...h.......?;u..{.;d|...*...q..$}....J..#..,.i.M[.o@K....A.i.. ....bt.....D......n...o#...c..&^>.........:.x1<..1.........d.`.^......0.4e.....~_[..A.7..ko.``m...<.6..03.......,~>.@XL...d.....U.L.....q 9.(y...u.q...)...([..R..RJ........@..IYn|..X.4.w...,....K@.N.T7.=\z,....G.*m.<.s.)t3m........(.i..2.1.!G....8..+i..Y4m.$...<.90a.C.....'p.f....{jY.._......w.u.C.;~fr.M.X...Z..X<.X.Y.^.s.FD..w)P...>..\0MTI..Y6..y....U...f>....LtV.ls.h.h.k.f...t.."...v.0".....[...TV.%..g<.....n.......W........dN.iuo.)...9J):...u.....Y6R...R.....t..}k.?.2>...OO...L..^(s..)..=...........*ID..\...V..w.u<#....xb*...&.m.)Xa.A.Z..s.q_e.6q."...Jf ^....-..0.....,.p|.7Iw..M.o*...>.p\.UnIF.C.OJ2....Ju..[....0&..p.).].(T2..9..F.K.E.<%...\."./.@

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_narrator_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37301
                                                                                                                                                              Entropy (8bit):7.995032077495301
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:afiT5nb69CK1yg2TUIo4Q7qGIRBPxtFyCP7Zathr1Xwhd0B:aG5b69logOo4QOT5X1whruhE
                                                                                                                                                              MD5:41F0276943750C08097BDF02A1A567D6
                                                                                                                                                              SHA1:0CA00451BB05424911109BD7AE7C2746306C4120
                                                                                                                                                              SHA-256:946F43AC4B2ECD37C717CC6B762979E75981EC4156B520CCCE5566C516ACC91A
                                                                                                                                                              SHA-512:443D17AA05C932DB102ED0DFC378F267298CD0BF444223826B42137F8EBE14ECA57701AB4F503747953BB84DCDE01FA400C6EC2FED06D2872285E5204F1CFEBF
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:F0Z.0.C.b.;i.*..=ux..'GJMz.v.C.P......f.kj|.f..[...p..3=.=.#.....!..6JG..#.CpU...N%..X[..O.M....v^.IO@..^.X.;...gM...;.. ..........{..:vD{.:"._.=iX../.....(B...Zk..*.-...N.....k.#B...#..a....P.I...|q....E.C_.'.L5.h<...S.\.4.....d...*....9u.O..N...-.0..P.. ..Q.O1.3..9.X_R!....S=.?.....fR2W..xU...]...<{DM...b.9.o".(..........."M.].F...d.-.......O.2m...Op....^...y..{..m.A..W...zO..%9.yHn#C.:P..vn.........{.ve.T.l.C..x~&.L....!KC.....VKq.......`.<_g. 1.~.j.S1.e..F..Q7i...aZ..~B...u.......p"p..+.$.FQ.%...H.........R...2E..!...vb.o. ....J...%..l."1.1)...ym..<.<.a$.x..|....E...+.J..>n..b..,I.J'........P........Z..N.|..Wb`DJw....u....~.b...4..y....T.."...>.qzH...%....%c>...gD..a.p..X.Z."7......s.v......^I......e*..U....r.7... ..T:...c)....#..f.a0.}8....O.S.bDP.>....4...."WUU.wa.8..n*..%..|...i....$.)3..v.xqm._s...w..UI...N.=>.......Z.@.d....k|..z.].]......-.8gA..!.D...f...N."a...1b.........T...C.ix&g.;.Kj....[.9.7ha....AR.`....x.{.mm..CPE...(...Vq..i

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_notepad_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37301
                                                                                                                                                              Entropy (8bit):7.995358505420241
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:mNWEU+Z6GZe2gKzy0L+lwpojP1KIxZuaYQpN2SVnxriMMqPxnFeXA:5EB7Ze2g30L+apsXxZuaPDVnxi9PA
                                                                                                                                                              MD5:2EF5313F06E021369BA58C1D5D3D2AB6
                                                                                                                                                              SHA1:754D5EB99096AF6DB570F1A4BE82BC26CB9C6E14
                                                                                                                                                              SHA-256:1222A497E04272DA38D22F138B2281E19D740C882C518C4C256A7FEF84752022
                                                                                                                                                              SHA-512:81A192844016E6A344CD8197635830D73EDA5B1F8C094E418100051089D1BCF29EEF3B04FBE4C951F045931BA5BCF15FEDED4E232AA6B3F004BEDE5FDE2C61FD
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.6.u...2EA....1.(q.......5B...G....`x..Ft...N..4.....]f...WIW.=..{...*Z ........Z..GL<L...3...p.Y..p.&....A..]...j{.&e..P..q.uW.......B.]S..O..K.....e>...J..... .......B{~u....S.'..Df...2GA:...`..o..}....9...y..Jg[...(MI...F..=k."..R.....2......tx...r.P.u.........#........6bi.o.?.~...z.G&..^...^.b.....f=.j...z9......@........S-.......I.b.?9mx.T....T.._9..KWm"...\h...:.[.N:.S.s.}........e,....m...u...8..:?......F..\..,...".O.i.P...+.L.~....v+'.z.z.a/,.K.....~*./..YZ...J.i..I.X..U....X..2.....$_.........a".....l....(..h`.y..uCi3[. =...../.u>..wI..Q...?.q..0...^.QM..w._......&h.8..xG].V.$...'.9.=.\O.4....A.X-.-._Q]`.V.`..K....M..v..r.....i.>.....Z.M.p..!">...1.L{.TM........Z.........z.z.2.[H.....Q@.#P.=..U....mH.....w.t....C..dz,<...G.q.......r%3.6v.~.1.tD|....\.....hs..=..F...c....>4.&..G=.,.Q.8.....L.h.,.@.i.......Y[...9.....'.g.........&...3Y.5...[(.;R.D}qt[.....k*...U.....r.......9..T.|.D.k`...D.\..)I..\...+.......W.......Ev...

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_odbcad32_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37302
                                                                                                                                                              Entropy (8bit):7.994832492811616
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:5brpIRGL/mKMkdU+avjkDVM/siMgXi4HpG9mQKqBo4HfA:hr2RGL/mCdravYDi/nMgXiwpG9HjeV
                                                                                                                                                              MD5:7EAE21C63A60299BD7D614B8B641CEA2
                                                                                                                                                              SHA1:AB226F725B929291D445E475610E6F87571CE58D
                                                                                                                                                              SHA-256:D13BEC8D6DFAC6DC95EA7C298DA013A58D046691C5A8FB6A738CB8B05EA8E2D2
                                                                                                                                                              SHA-512:A1AA5E80BE27D1FB38F9EC9E1E9E3390B98FB7013ADC55C09E5DE444CD761B548FE86FC78D7B7734DB99D55B987242BDA2C8B62CE502548C564992CE5931F25A
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:(.7...5...F.}D.85...3..vqs..s]p........VOm;.>..S..T.f.~.\h....Y.....u...@.i{..-..G.y.<..3i ...O........M.fi.xn..............5+..{$.0.7..?..3......n..8....).7Y...s._.......pP...S.,K.9.m|.....xo.!f.-K.ON&\...0.`.FF.8.s..l..QNY>L%p...C..A$4.I,...!...9u...,(.......Sn.b..h;.V.>..c\R.9..D5v...~...<w..f.,...I..//H=xt>.QD.Zr...x....Oi.....2...P..{1+..\.n.u...b...E..&....d.....Au.......6...@a........o..C....~w....De....2....7....J..$..E\.]..M..d.S....a....,..>..S.../;3..[..}.b.$.........4Z...........;.h....$....JQ...t....`Dik.......b.u....&.3.]."J.?..?...:b6..\}...6G.H..........8t....~.K.....VK.-y#J!X.W.u.J#b......{y..G`,5.^ L...).......F..............O...kWS.+.go..D.G....Y.......&6H..w....O.v..r.........>..2..8.........c.D.0.F7.F.#'T..*.wWkk.Cd.1.z...LI.L.<....q.&S..d.........lX.:C./.)..N02$!...*.H;....&E.j.%...=A..8Z..D&..d..G.2......m..5..}R......".'Gt....W&P`v.-T......RMW..(.f9.g.}3......`....r....6.P]/Y...Q.aa.aE....r p.....&.-f..=2S.6%.yK.{7

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_osk_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37294
                                                                                                                                                              Entropy (8bit):7.995609320072209
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:1L5aMUFlp4K80IyMCzBW7iqy1PTWC6/VsSZBC6IN/52Ct7KhkGx:KFFn8FkW7iqyJTWxbBjQ/52
                                                                                                                                                              MD5:7398A960412C7A31CCD3CFD4F0B04859
                                                                                                                                                              SHA1:41FE7B9DA561A05D713F33BCC37B31D63878D164
                                                                                                                                                              SHA-256:85CA321E908638614AA6297C672A0B36A91C156FC1AD331AE20DA7A5BB821259
                                                                                                                                                              SHA-512:0D86C2DC0B87A5855DC5B26DDD047EC41860105FA28750D5476291EC8B04DA8263C60F8A9D6A1F79428BD2824CE75A6D9F246F9E98F33688035BB49B18C4C66A
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:o.... w.e..}.sH..K.$6?.~..G.C;x70..[........`../.k.X...s....S..q..2Q.........6:H...t4..]o...A..{..#.....'...~c}t=...6..55.m.F....Y.S..9`.N.........n K.q.R.....'..BG./+..Z8Q.u\ZF&`t.h..Xc..o.x.z>.'..RF.V..V..e.t....Y...X*.<.zCs;C2.8.@....e...n..k....I....3.^B.... ..#.k...".{C!J^.g.t.(94[l...}......W.....Q...h..d#\.0...U.\.>H....8k..o......Y ..V....5.........d0..>....U....V..:eH4H.W]^o.W...Z9W.Q.&.PN:..}.`.*..t...........Z.6A...qx..E.*~'...g.p....)wh.=....y.#..J........A.P...r..E.j.4'.....P......BQ\....E..k....`...>.{[.MQ....W.Z3.{4ec..B.*..X+..X..=.Jpc.,..2~....t.X../>c.3..I.....4..J.kt...t.g...../!....0.Ud6tn,.U..b,/.y....f.E....6.....PS.+...AT.#....f.9|4-z...@GZi....v.o>....o..3RMx$..m..{.2..H.....F..L.d.p`.gP...z...;...?yj.[..}.h.r...........F......;{..L@Yg......v.(..3..9..9.m.%PQ.`.F..!..n")..Sp..D.pE....(.z.....|...X5:..7F.9k..ka..S.......B ..N.5D}..[u..9......v.M.&a:..........8M.-.K.p....(KH.@...$Q{../......"V.w.a..o0....

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_printmanagement_msc.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37312
                                                                                                                                                              Entropy (8bit):7.995484400156124
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:WUuaJpbF86owGxjJwupOSxO2B2hsuhIBFOVSSiu:WSBwxjugP2HL0xu
                                                                                                                                                              MD5:B77D36F5F21A312ACDEFE478B5E9052D
                                                                                                                                                              SHA1:C46C788D40A93D6E1371B708D63BC94580CD6E4D
                                                                                                                                                              SHA-256:65C07D35B595FDA03E1BAA6912C3F5EF0113D4434C224F319BF3C3EB54C3BC63
                                                                                                                                                              SHA-512:2788E20EBBBE4C46F925A39D078894E176D5E5660E8CAF7982ACB80452D918778B4A05FA866B2545447C8674979FE9922D40B06BB93F9E00CE8789743FBE212E
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:c...'.v!...n.4..ZY|g.#\...AX.k..~^....i.....8Cu|..TM....L....gA.@5......:.A.x1.6.$Ktr....1..(..<j..eUI......-i..6`...3&..`..g-......O.Ge...e.z})[. R|.@Q.o....#..;..:...i,{c...r0.D.[.#..n..^`.$.t..'........Z..k#.1.i.W.....#.{...2.W...&.#.....y...$r.m..Z...%..[$...tE..Z.U_..d...uwX.3U...NR.9..Y.....#...:6.X...9.{..7..1.CL......u.J-.&1.~K.h..-;...R..c#[.QY.t=...3I-<.b...<)..U..[.%$..eU.....A...3..E0i.jE.)......v..5.<3g....t.Y.G..IsD.....%KD7.b.5y...|0,\....!;.5..{.......=.R.4.C1h....&..z..T.....!.......".Vz]....z....u4...5...x<.....o.....}..J6n.Us.....p.V.|.oQs.fH%{:.%A...wJ+...eG...#E;.=p..P..gti..)....:M7.K-S...i..G"/....W...1..... b.^..\.......AA..xT8.WO...:.;C..#..P.R..F.p..nrQ;...g....G.w.'..DT'..~..`.;X..K.l.i...Ca..5$.=.Lb...z..[...>..._.qp.2+......N.[.^5w.]P...0=..j...ZE6.Y..x.Y..b.<..j\....~..c1..I..W.......].`A.V[.5r...-.Z.....{.<..k.H.=c..`.>.U..J.....L)Rl....].._a8....I..;-v.#D.U-,.......s.L...o..............|.m..a.W.H.'6.........

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_psr_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37294
                                                                                                                                                              Entropy (8bit):7.99525636833548
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:J7ipwmBIrkUzwGfPrblObU0Smt3Qy0snsqpfm3JZORiqRCq8FsAjtDIN9tP:g4/7xZ0Ltgy0svpfY/a9cQAjt8NHP
                                                                                                                                                              MD5:07EF600AC6856AC4D0BCBE96AFE2495C
                                                                                                                                                              SHA1:972BB67A17B58F83A848D79E5681D84316BABD43
                                                                                                                                                              SHA-256:E062F21B61D499227DE49F9C166E5DAD66276E38781D32623DAF5AC14C4B8E22
                                                                                                                                                              SHA-512:E54CF6858ACD0C67754FB09BC555FCD483389784DA9966AF24C106116FE4E73BE56F1308D5B3BEE43FB1B1DA0DA576C322886DBED938AE2CDB6327D355A17B85
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..)..mB.N.-.AR.R.k.`.|=w@.8.~J.....}qq...p...kS!t.Uo..#...v..J.J..w..G.,.j....Af.]13........4.N.A.i....G.wC.Sg.....tj$@.............D...`.X.f.....l}[.P..O.A..M.....YN:..V....v...l...E.....SJc1.#....$]x..I7.](..mO.teBx..t.s:...>...(w.....l.$%..iekj..;...W.%.{......T.^..45A...IxU.El...l..3;...SEW..W.....J..to7......L..L.xQ./l.+./*Lo.......^....,<W.._..]c.-....98.....ke~..&.[........n...9..%z..B.4...B..$.....@C...._..VY...![>.....T.Cu..K~5..Ev...*v,F$...4T..K./:.S.E<..;.....)@h...........*.I.....Ir............0..i.:....g.#..|I.3A.#Ve2ZaF(gY.h.+..%#....4s.gs..~.v.{..@.%.|.w.E...xK.....jFt./.1.fcC% ..e..C.c...&o..h...5PT:.X...@@.1...%.Vb...t......|.v..........D=...o.Y5~g...lC...x.D.... .;s.0..s..B......%LH....h/.A.J..KX..7..@/..T.V7...DY......i..E.!.....Mre.!.C.....hM'.j.R.{...@..,C......g..V....'.....}D.....zue..2.e.x<\g.bw..|RaT..b~.`.D|..{Et....+..@_....Rv.|E..1y....V...D..<.^i.W...5.......Z.H~...Y..%y..(.$.....;[..'..Y8S<.lo.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_quickassist_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37307
                                                                                                                                                              Entropy (8bit):7.994558559665564
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:3wIli1TQn2fM3ZSW7NhsgWpOZQX/B0a0l4DkXtFHuTTjrVxqSpgP/:3wIgTc2E3Rwgeo4/Bnc4wtFOTLVxngP/
                                                                                                                                                              MD5:867BF74428DACF858927CFE796A7EF1E
                                                                                                                                                              SHA1:0EA85E194D2534DD6C10C76339528C6DBC61B429
                                                                                                                                                              SHA-256:5EDFB3FB5A8EC76C5C0D2A6A0684CD30A273BF8A8D230E3FA9A2F936FFDE4E34
                                                                                                                                                              SHA-512:CCA00AE175C222E37B655125762FC2219CABDB8C74B6DC764E751DE276B6868697BF84E93A7920EDAB61616FE1C3C65222E29FEC41ECFD43DD6E5B6529555ECF
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:...O._.. .[..GN.....t4n3..-...{....e.d....cV.>.2j..R.u..C.z....$.Q.aJX.D.&...n|..BRj..^.....W..?.[.D/.c....)\....Q..S....KM+....|...u..Jh..KL.=.'N.Q<.Z...~...9....3.S....C..o..W...~R......F.R...s&..n.@q.R.!...........k.t...Y.`..<.=(..\f6.w.!.yr...o..`kf..8...w..h_..`.....p.P.."S..z.g..$t`...1N.=...rh.....;^.E..........^..q.5'.O.A...P........w..Q..L..L..9..P.).0..N......<n\.2|.}.P...4..Y.^A..kXx...KWRJv..n,......&z..s..V 1.b2...(T].`.f.. .iEG..)..6.....)...dT...Z..4...Zt...-Y.R.zx.........C.....0.M..b...{......?......yu......P..]^.yd.R.w..O)GE......[.....daW...h...n5..(.).....(.b!.l...X.........>..`O+!....k...qgUz.brl#rN5p'.........ZCI.r.(O..'.r.v..e....P......wK.. y@._.5.*.]>p...b.]K..v 2..T.....1bA..G.n..*Q...v...K..nc.~.4j]....k./.d........sS.c...qd...H....i....l...5...H...#X..X`.......Y...W.......j9h.?AI6.@.+.E..:.b....V........i.[.r..).*'.(..X.Q..z..Pm..=........b..4...v........PQa.O..a;.sJ..<.....O..W.i-....x.d..}.K...r

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_services_msc.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37301
                                                                                                                                                              Entropy (8bit):7.994640755415693
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:iYQp752uhEKTCg0VtexeyPFDfInvASN0uMM6P1A1oJ:Et52u+S0vEeipi+uM01oJ
                                                                                                                                                              MD5:C4D9C8242BBBFA39FBC3F2BB6D963FCF
                                                                                                                                                              SHA1:4473EFD0550CE3E0FB7AD51D4AE7C8F5ABC0FDE7
                                                                                                                                                              SHA-256:5B686A567B541806C6C94AEF4A6932ED751A62999D30B54FF4CE7550ADCA3D98
                                                                                                                                                              SHA-512:0B9F4EA68933AE26181F209AFD066A18BAA2D3EAF9F1016BCEC87C758BD5593A5A07AFA67725C5973165E401168F916AEE91222C507F11F0F70947FCF869217B
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..b..p.....*......".(.w.H....u?N..'...\5.../....T..|..0.2....<..Q.......'O.HRz.YQB......%S.. .Pg....;.....Bs...~z.n...?...|.CZ!i.%....6D........Nv....W.Z}f,.b.s;h.BD...|...Z.x..~w...R!.H...S}..V....g..Go..Q...-...y......?.b...#....$......P.L.V..a...z':.u.wu1Sr.:p.l.........*...%Bd...?B.L04...@\..w.r8.}...j.n..p.(.G...D....mU.f..Y.t/..K E.X.*.......a..S.4.J..d~...Q.J...{jA.....{I.}..^o..-.................A.=...d...},'...S.z,l.:.S.f...pI.i..0Qr|.... ;........>h.d....._S.D'+...[.|q.*r....Q.3......Ez(`.#t.[..O..8.v.'.8o.2.s....#..U.MjI.....&.X..y..Q.%.....;M..f7.eF.T.w......=.Z.k..y...kh....#]]|.>>..w..-..m..e.x..Sd.m.....Q.:..........|....".'.......$..)......./.......wuL..zu....'..C*...;..\UE.....w..k/zy.s....I.b4b}...moI4..)orP0.o.J.JKV...s.#..j.q.U......q....Eesx...Eo..pc+......$.....G.(......tV.X.W.....\Kq..L..l..q.T@g.....f19".r.O"....~N7.^.C8.[.%...A..}....g....c.R..`L....{.........q.q.b..E....%y...........\.....&>.(...N..Y.....9.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_7-Zip_7-zip_chm.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:OpenPGP Public Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37300
                                                                                                                                                              Entropy (8bit):7.994297853074811
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:eBvw71DboJ4qrJwlPnlKz2LugbECYVWvYTfQgsGDDs:e9wFoCqrJQ8zII0RG/s
                                                                                                                                                              MD5:0B4B3572570BC3738B83AC30A31CE36E
                                                                                                                                                              SHA1:E8A378BE22293DC063C33AF18324BB167FC8D39E
                                                                                                                                                              SHA-256:4A84974D49D204FB1AF1FCBBE398E6BD034179FF370CA2641ADB3DD998E77B10
                                                                                                                                                              SHA-512:7923298D9973D7C08C69EE836A6423A6EAC0ECC57356ECB4868A7CDC9EE74579242F143FF007D111B996A84F7225D66C484BC5F2335F645CECA869130A9ADC98
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..>W.C.z..}4.........%&*.n......@pmZ...u.W#T}x. ...k._.E....x.j..cj.t.L].Fk^8t.9..J..^.:=..CQ........ .)..M.mkh..l..L.L...?.n..<g...Cg..`_.zV'>.3..r..(dbJ.....`..g.....c..O....<.r3..B...\..>..I.W..__...!.MM..N....$.....q.E.....(...^...FQbH'N...0...a.\./..._..a.z.\....B.i..FE.c.U...'%.W.....x...G+...{[(..%...8.....o..I....e,..AM....Y.-.T.......(...`..:$=4.......Bw.7.....E..y..%...%...Q.iM..!.!1.5.N...%.....,.....Rw....c...N..V...!L.QT...G.k`%.........=.R..N.)..&....qQ.2d..`.Z.@.....di.`......[.................R>'..D...{..ac.E..~5.C.;0...........dBF~..4..$.Y|.3GC..2... ..H...P.f.*Z.[.R....'z.._2..>D*...lHPp.r|U.I..&.....7.C.~th6I.*.,..eK}....+.yJ.g.R....B..%.....J..Tq.S..W....m..f.$P&...."%..{....`..!K.]./..L..(e..~.CW.....0...xv.T.7.3~~?......=3*>.O..X.?-.&.J->z.R...%.p#.[..X.6.][..#.......P4#.|.H....*........p....[..tVI.....8'....s*....F..G...^....Ix....]..Z..Z.....p.#..<..<..W....~yg.g......f.-..*5..}.Ln`y.Lq...hA'..s..+..`E|.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_7-Zip_7zFM_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37301
                                                                                                                                                              Entropy (8bit):7.994960829521996
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:PP5LNbWfDVe73/kpvzoidDRAKgHxaHEAhtm0777aHACl1P81ly0FN6gO:n5pbWfhe73evnq/DIVz7CXmlUgO
                                                                                                                                                              MD5:DB3F077364615E1CDDEB7F871B401096
                                                                                                                                                              SHA1:D5F41A8C3EF50EE103C5637AA6A0840D53699162
                                                                                                                                                              SHA-256:9E5341CABABC79ACFBE06773F7D5EB52F213BBC3E09128DEEA3479B0D0A841CD
                                                                                                                                                              SHA-512:8EDA6BFEF48B349A53B1A60384F1E160441C15C428D8AA93F8392F3C95761F0D19169C3BD45C40B6C4C326394536C457872EC620045A21816628630039AF8D98
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..L...7....n.T6.U=N.......&6....O..n?...[..B......#.6.W..+3...J.V..M. .D..-..5.>.v.A ....p.....#.3&R.Z.. ..-..?K[.....j,\.o..r...n...!A..%..]$...b8..k....^.".l.H..o......2E.B....;^A.N..*.y..N...2c.sL&y..*h.....7g..-t..:1.GXhs.@.x.B...l...g.:.M.........*Yd...>.2.(0.f...<.0...<.n.,.Um..8.J.f..'..WZ<..T.C.".....2../.....ZJ..\k.4.G.3wdF.|..n.........0..u<X.e..8.Q&...G..5....i....-..<..x..V..BG.kw.j..]...+k|.1.../....!..E...p5n$....{[:.y..."!.7..X1?{....c.oAk.\..a.n.E.;9.P0...Y.....5..g. Ap..lt.9.D.F)Mu.c)u.Bm....J..G..mJ..?.m..J..u.Q......m.DT..i...V.T.t.oV.....M.z.Z.NRV....S7.oW..p..U.T..`.]..R."s&}..X.#...M.r..o....B.b)...,.5$.xjA.:...z....>.b.[..vY..]..rF$.u...rb......r.{...../i.}`k...2.......^...._.....\G.........i.Wj......j.A!s:.........w..O...).U...iG+v.....1....*..z..t...a=..J...f.e...Vz.T..0K.G..DF....|Af.0+.L.....6....6.I..T.=..Q..I.5.......{...z.......x. ..[l.....JKp..b.G.u..^r....U...x^.H.53X.......a0.L.........!.J...KOu.W...L..

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_Adobe_Acrobat DC_Acrobat_Acrobat_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37314
                                                                                                                                                              Entropy (8bit):7.9947550088339625
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:pePDkAx5CoGrO8+eodkmrWMbfdYWpugfzOVdxnDSfnIOSQjrIA+G:pakAx4rOxdjrWMbfFTq5nWRS6IA+G
                                                                                                                                                              MD5:5AFD77C6E0D26B8EDC89D0CC7341CA4A
                                                                                                                                                              SHA1:026B798EE7D005BC84D4D7DD7B8F7278B7AD894E
                                                                                                                                                              SHA-256:C9A75344AD60FCF66B551AD612A5916AE557DE190EE7C2465DB841C2BE8A3645
                                                                                                                                                              SHA-512:A1A849A1D82D0C5FFA5A6CD1B44EBF455F80FFA231200B3AC5628E3E6CF2F42A63ABCC4B027583BC9D6187D0B9A34C80C2A24C00FCF069E30943331AB7578CE6
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:1........y....{z.>.....R.....(._......3x.i.KT?...xY.k^%.e.!.OA..p.S...<....ue....f.&>.(..-..nUPE..*....w....N.&|...0..P......BI..O...f........fX..n.9.5tQ0..R6&.....m..(.ji...+....2.....#.M.;..._..XET.........J..E...~'.....w.......eU.....2...W).l~.].w....PbiG.....s4_...d..UV.NsG/.0C/4...nH!b*(K....$.....N.R.w..TU.)z...7.w..b2.m..Cw..) .iR....Q........5.....Q...{.tr...(c.....Q.J.47.7.1+{.hA...q...r.v.tj..u...z.I..X....c28%..R..1..j..Gd.P..0..KI.p....Zo.==.(OM.qq.P?F.B.F]......A.A..&....... ...J.GV.[;.....&...h..m/.=:).N..b.U....[..Kb...9:[[..6g}g&.fQ.(...F|.<..b...'..)...h...!K1/}z0J;.Vk..~HC.....q..6.. ..w,.'}p..z..d.5.s.z....._..=..q..X.D..O.....e...U+....jcq..QX... X..R...l.h.;.4....._..cC.[...Q[d8b0..sl.Q....$...U.1..p.`].Ll....7.=k3\,K...Z=..-......"M...`...R.s...4..C..6.l...w.d.."...p.>.c..TR$....Z..y.*X..&o@.E....D}.h9....O.@;..{$O..w..D..........P.S`+....$RJw....#y,|Vaz5.._.<....L...+..g.}X..!C...J...<.<..+.\.\.D........!...l.:4%..

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_Common Files_Microsoft Shared_Ink_mip_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37342
                                                                                                                                                              Entropy (8bit):7.994854120951023
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:pNxCVtRKUNN6EEs3xDhAcNU1vumR5flbv05clY4XjNTbbS53:pCVtUqxDhvsm6F7TXho
                                                                                                                                                              MD5:D9593A0AC42ED2DAF7531B9B19502FA9
                                                                                                                                                              SHA1:32EB24C1E29DE75F719B6F43DE4687F4F938819A
                                                                                                                                                              SHA-256:7300C23C11C6675B196AFBD9275B1D39791475432A51464907F54B4E52F82BFF
                                                                                                                                                              SHA-512:AD56A97613AE42CD28CE5F99FD8CEC36AEC60B0EC5E52B39395FFE09AAFB90A45CB7E28BE21F252D1AE03BD7A87EAB877BDC9153843CD3C52573713BBC7F75D2
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:...ZCT...<.......{t...6...A..)./.$..*3X.4Md...=p.p..f......*..|....Z..p....K.g....q.....-uc.hx....`.d.....w..Mz(.GS..,[[/}.....)....=..U....JP.d..s..K>Y.%.*.....y.d~..r.Q.81D|.D.5.Ys..u%.0.O4..r.8...c5........`@.2Cc.?..].+&>T)...1./E2J&.E.....t..+.....ZK..e96dv.I.X.....6....[*..i.....v(....b*1gK]...(.h...#..Bo...`j.w.a8"..6.3b.."....*.x......dA*0..n.j.....j.<......5|w..r\..B0.\.4..!....f..5%..8o...i.K.......1...@.b....?M.fof.G.....S...9+".(.M4..}R.;........G..x.S.6.zH.t...| ....@.v.+A.u.J.....a......>{..o^#..4.c_z.4r.W.u.;.(.1........7Z..8......^...G`Q..a`5..I.(`0..}...o.V.;..[..O..t.$O.B..|#.pD.:.......R`.x..Z....4%.....-........w#0..sO)....d.e...h....-..e.M...$TU....Z.g.u..%.......q....?(>bN.-..4:...........lg@.:my.:....l.?.}.\..T..]t.zp..y....N.>2.S..wq..SS....7.hu..&..^.|R8O.F.5....?..P($T,]V.$...H...`..l.4....]..;..D.na.......^ZG?e..6...$...w............}N...u. _...~..F#;..2..?BM.......j...M....1.5.4...~.'....X.....

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_Windows NT_Accessories_wordpad_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37332
                                                                                                                                                              Entropy (8bit):7.9954747133061606
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:G17AtEzg7lSiAQoA3LuEoKmZCknUibxE8gQPM9kwLPkXyU0O+ffDv:G1UazxtK3DHmc2UUxYQPzw7UKLv
                                                                                                                                                              MD5:E5FDC45778CDD8232EE05D3A2239162B
                                                                                                                                                              SHA1:9D8C7890A5272DAAB625147075941F6BC038CB97
                                                                                                                                                              SHA-256:B9429F436D25E7C6BDE7970931C8675C6CECA9059C4BC37DE8C9B524EE92EEE6
                                                                                                                                                              SHA-512:FCE080C282F1B16B5B8F4B9230E6ABBC6B78CE37224B849684189FB20469AB713FEA0F389DA940AFDC93EF1646804E6B70DB723CF3C2440DC650DEBB0A6AA9A4
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:_.q..HC.......a..o. J....u....3R;...3..G0I.z,.d.....J.]I*v&...G..:._./C&....>[.I.X....!/......Q.....?uv).b...:....t@.f..4.l..R4...Xg<y...9u.?8TV...P....=.....B.\i.t.........M..$....uEKb....>.....Z.%>...n.L}-#l.N../l2....!.o..g8.]...}.D.f`d.qC...........i.NPX.....+B.......v......D[N..._aN.N..D'.X5..ca...z.....'..t..h....._....5ZYo.../.^.L...Vy...U....2.<.....o{...........'A..cG..abg...!./+U.G.n.....d&..0.Ey\HM.@...Z.O}.|%...'...8.K...s...7..X..[......*.S.j.3....h.!......i.g..vKD...7;...Sx.'.....+6v.P..lP&.(.`##..y.....>Q.4..|+U.....S..........U....."t.1.Ik.~~.}..F).Y..G..I._u....5..e....R+..L%....b.=....0..0.3..GGV.D_.f..!..hi$:0....KzW=._;@.....k..zH..;6...[.......$d...t.aY.m.........3.).+.I.P..$.h.ne.o6esX.)9..4)Dj.._..j.6..MO$..A....+.J..9.Z.j^.H.P...&...9..............0.......Q...7m..#.ys.2.....v..._....c....t_..m].M..k..{~...%6.......t.>|.8-.q.....=/..T..........5...7...H.o.4.)....2..f.c.n.$P.+.u>.P.m.......s...../.4-...J.$..Q.|...

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Au3Info_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37312
                                                                                                                                                              Entropy (8bit):7.995302774362903
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:YIWeuSqQFJBEcT/dluccpNpSkAfROSLBwlzrccXG7vmMUU:iSJXBRTlxkAfROJXW7/J
                                                                                                                                                              MD5:1221676ED155B909E1429147893F6CE9
                                                                                                                                                              SHA1:B81D79308A3A608509115DFFF2DA3DF731425465
                                                                                                                                                              SHA-256:5CD4A04662642C881ADACCAA035DCBFAB6F157D81FAB0E7498E6E49025BB8E18
                                                                                                                                                              SHA-512:1EAC34BBB5977B9AC8E44D51A2C386BFBDB7BBC0C8D2C028D9B902CD5549A6E4A6BE5E400489975FB03CD9525B73A435564EF8802543E63158768CD1C45C4E09
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.|.../5...>.`.........0n....r........mQ...#.J9.[..5|C....8..z..,.....k..s.o.H.k.!..&....2.+.E.TI^b..8.._[........6.....W!...n..W{S......M....P....W.)...b...Z...t..]...<Q.....+R....f............'..X.<B.....L....j.E.\2........f{.'$.,)w.^6*....W...|.x......S.3`u..@...]..F......CX...@.K..S,.F.....U....j}..(....R.{.O@Y.L%...A....fez?..c.~.S..BU.B.[Sl...!s..7..Yq..+..&.s%..) ....,.....($.9..YT....?.D.7.';)C...;{..b[.@.PgKwepr/.7..S,..7.b....nL"-.y.^i[..r...,...g...K.. ....).,.Ww..k.Iy...Mp.?.'W0.X..xBKN....;.@........E.E{k...........Q......2..cb..s......._....e4:....P\..c...............y2...F=q.IdTP..WS......tm..c.....A..{....vG.......P44.....$b..;...8..Y..05P.1.`.Q.....om.6.:..f..j 5=-E&..L.V...h.F..*...h..n==C...f.X.t@...N.J.%...s.\..&..8....J......'*n....... v.V..5.~.qy...@..x.....$.|.H..%..2......].i.w..#..?..b.GH!.e...H.s.h..R..>.......WR.,kq....be+..@..J.(0E..>TOW.e....Ie.....,z....C..B.;KaNg.S...GT..X)9......!.._...:.7&.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Au3Info_x64_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37318
                                                                                                                                                              Entropy (8bit):7.995376695219518
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:QCY9m9RR20hT+RWT4IHW07kc2zTBnfSn7hvPyFQ1WV:d9RR2nRWsD0BGnU7hXyQ1o
                                                                                                                                                              MD5:1A255223369B12A32CD05A4F38B6E85A
                                                                                                                                                              SHA1:254FA0D42AAEBB499A40FCC43F8D564D425148DE
                                                                                                                                                              SHA-256:067D227A8E8570793D6475516D09BC3A7FCF1C88C154268D8E6AD5812AA522F6
                                                                                                                                                              SHA-512:CA6E8AC15963561474F63D682CC86358C91EA92EFC1363CF806015D204A6032F93C0704C30C6CB20D886F8A5533DBEFB4B9CE4F2CCA3A3D588F56C6C8DEFDFAB
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:...".+Ki.....MT*cm....?wT8..5.W....wH....hbNR.z..^...F..;.Y..7..!..'.<c*......s(.jf..r...{q...{..3.%...V.;.....q...DL.".l.A...U.F...%N......h).iiw'`,I`..1..`.B..L..L3)..T:a. ..x.k.ZZs....c..+-..)..=nY.yO...[.H.,....x.5...J.x.$Hm....>._w/\..H...W9.......3.%^.....W>...u....q#....v,...........t)y.........d.[..o.&.V.j".....t.M.....^...?._h)G...DL......."...Qe..e.O....]0.}o...9+Q.fxH.........l;.oq|8...?.d........(q...@...U.}..9.0qf-k.# .z{.&ei.....5 #...<,...V.^..L(wD'...Z.".'.`}...}.@....!F.m.Iod..iS.=/....Q...U#...k......,.........{R.>3_n.{.!t..icG(..."..;B.IK...k....a\....x...........m...Z..Z.Q......N@x~0..VM.......!..>.?.|.....m.....cLT.~U./..`....w.....r/..b.z..k.=!k.XBx.......7.u...4...^...w._.._......M$.......3k\e.B...G....W.Z.3..i,.......=..Q..[.0D...v1L..p.......:...&.....;......@.ea.PO.4.._..+?.`..-G`j.>.0..3.Jx........+.NVw{<_.'.)eb.`...+.X)..x.uN.gn|.p.0:..h'..xn...l;.`!);.....".Uy.%...(./..........j.....'.p,. -C..E#......?U.i.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Aut2Exe_Aut2exe_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37311
                                                                                                                                                              Entropy (8bit):7.995408399428597
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:bo7zChyfjMk3CFCwNcEhtHAT+vgmfQjOWWa7UT:M7zjMk3GCwNcEfv5fQ3WmA
                                                                                                                                                              MD5:040BF2A2AE89FECEE63F05F38D77CC2E
                                                                                                                                                              SHA1:F758138950C459FE53A933DD4B5733FB87DEBDB4
                                                                                                                                                              SHA-256:E3358062640F49604F6A2A920D06FFFE93DC3FA4BEFEA142DBF2E5C4FCBB585F
                                                                                                                                                              SHA-512:B86D827FA57D48728FA932369B6430A775896029A76190E678B603BC0BF62B6FFB3360F8C595BDF2B6BB5D10B9EDDCD209B1A0B379FF0B873A2CE8CE5BC9D3FD
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:...].;....M...+L(-.....>.>...W.........'......v.].2..2*.^`[.n$.6...U..........*L..8.1..\-6..c}oH...O..w8.Z..../..:<%^...Z.......tV....W..O...E.l....Cm(!u$..W...#Q+....w.<"z`_..C.u.v...W......}_..Z.+.K..(&1.@.xIHX|.s6.E..7i}I.0^e..\!......hJ:..x....Wqd.......L.}...D.8........ 0.:..=..iI*.....xB...J.3n...f.U.c:..I.[+.1.l......Uk_@x.0.JW$W...x..3'..... 2....Tt'>Y.f/..p...O]~G.Z.=9E....Rh.J.F...#..Bw3...%?..!..aP.zy.D..o=.E...P!.....=..=....v...{..........I.A2<..+.@...s)%.?.z...>.H.w........"..{.Z..3..p.Q.........u9....Y.(.H........l...#.-..GE....*...Z...Z.....l".e\.lE............n-....p...^.t.....B.....*..X.xO_5..m. ..w..ie......i.c.D.j..&$L`]V...f.V~.k...f..v9..e.$:%&...W...0.=....d...Z....t..l.....P..=.E......7..>.`:.}......RfP...}.%d.}.zSN.V....|.....m........!.@.L..D6...~....7.....$3@NUu....5ue>.1..J.Y..c$4:.W..(.5..m...z...W-...Q?Od..p[.;..i......F.....}.........j..x...l.-........S....t.E.]"j.t.....!?".......4.V.r..j.;!.I.y.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Aut2Exe_Aut2exe_x64_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37316
                                                                                                                                                              Entropy (8bit):7.995326597238135
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:pnWEgM7P9If4P3+nDQNgrSeR2FdJpGwbg65m1WGwTUOh9J4:YEgMtP3YDzOeRyfp9bg68HOh9J4
                                                                                                                                                              MD5:BC87BF51915591BE376707DDCD335D23
                                                                                                                                                              SHA1:0ADEBCEAB9F70262DB379D0EDC1E15FDB3B6ED6F
                                                                                                                                                              SHA-256:C48E5D1CB75CCABE19C7410DF19ABA3EE96EF16B36C82F55911F6EED6E6EABB3
                                                                                                                                                              SHA-512:7EF31274609A991DEF14C57ACEA0BB595929565151B158AC5EB83265D70BD60A3A4CE3AFF555BC6D33E45C871A655C69F04D165025ABE1B0D3C3000E132B0EE8
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.!.WF....VZ.0.B.n.$.~......T.....d....."..iS.!.....D.L...q4...........U../.......l..Z.....F...V\.GO?h.}l\T"{.v"".... .j..fl....K;5.;.9...-.`+h.Og......+..qC.........0.Z.0)...^.7....K.>.....~.uw....*.tn.......)P..Q....!.*.D.#a...R......1..q...T.r..<S....Q....}.Jm..N.-...&X\}..........e..Zr....F._.......\.8a..;..:s..._..&.. ....V.."...L{.9. urV.h.YE.#.b..G....%K en1W..K.fZ.G.s.....?`.4Mj.om.L.WD..aWJ.<_...O.....X..=O.......g.........1.`..fd..W... .....6,......M.v..b..W..U....?".$.&.9.^&u..k...*.......Q.|...;..n.@......?..D...7=.mi...+..1\..d.q.....n.{.Z4.&....;n..FE.4............W>J.L.IF.K...}8...o]....3sh...D...Y.X1..Y...5...w..eN...f..F.\x^...........(BjCZ.\IX..T.-8...0j...l;@a...wW....x..69.w..\q7...M.."m.I...............j5.q..a...K...QF.fo...&bD...z...Vra.]...$6[..Xz.#...k.F...^+.x..f....H..r,(.k~.7."....%$...."....I.%...Kn..I..3U.#.2;41....W....-.-.. .T.b...<Jhe!....s:......X.<...G!.0w,.......?..j.Ni.i..Wvyh..]..}.L.^.lX..pe.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoIt v3 Website_url.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37324
                                                                                                                                                              Entropy (8bit):7.995331690300664
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:c1lRdo0wXjQ+zhNoFuRZlwZqBXvXRqzS7I6WKr7ALqahM6AOZCT9VF8:crshXjRdOFoXvVqKr0L/hM0
                                                                                                                                                              MD5:76DA9E38EE70E2369E029EA261373076
                                                                                                                                                              SHA1:D396AB33C64D2AFAD3258FEB4695F9D59C7FA1B3
                                                                                                                                                              SHA-256:6C0F69485D171C4D7EAB7652E42E212C65423089EFF6C62477A2382415B83BD2
                                                                                                                                                              SHA-512:A5BF0E728E15AB461A4D16C2AF4C9B6B781FA8987BC7D442BFD12D7264B1049A19DB13E70DAFC0586E68BCB322C90293F0F1EDE94E4478E28AAF96B86BE3ABE8
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:!J1....K4gG8.Y.G....y~......1Y.,...._..\.SpG...V:..9....m.....,R,k.!,...]..).x.Y.5P...V.z.../....,[.!.}.9.E.06....1.....4.X...@........f.I}.6.,t`..,..X.S............Nk...KUO.......yz_.~.p.......L....7..E...a.)b..2.j.....O....-..6L.cs..Rk.1..M. .....Q0n....3........?{6SX...C.6.OX..B....p...F?.....].A..~..........J."..n..S....c.HQ.G.~.....|.3...bo.2.6b..0U....'......0.'.19.Z..~..sw.Fv$..+.&.....n4.,.\.w.}XnnO_gk.1......'?.x...&.]9n.q.<...a*.d.|...k9@ ZO...e!...Q..+..?....%.z........N)..2.F.O...;..iA#...fb#.dc...;J.h..P.f>N-.?......uW)..@.1....F....D.x%..(.fS1s...p.>.c.f.:.d.E.S.V...5..\..."uj./........7.0....<...&M9WI..p.h..m..^>?.w...U.....j."..x..O..:.....(?Ao$X...........~{^......<Z.w..?Gu.;ue.Wu...M....M..g....Esk3ff......1...n..j..K...7..T.8j..Vz...........Aa..&...aaY....I.9..!.M......6QU.428.y%..R}... '0..;....I....--.=...D....m[..a}.S...d;Zk.7b..y........?..4u.l..Sv...k}.N...Q...#....lz.OxU..yoe=....I}Y.s..

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoIt3_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37305
                                                                                                                                                              Entropy (8bit):7.9952411543903
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:9RUGzfnAnEs0ja8TlmJ5FYpSbYTPYV68HRnIKuZbonIIXqD:Dcim8RmJgjwV68HRnIK6P
                                                                                                                                                              MD5:0444325278F78AB3980267027F9C65DF
                                                                                                                                                              SHA1:19C85428F1B3937A865227E49BDC83BF809BAC94
                                                                                                                                                              SHA-256:0E44EF4E5293FA580509E757112E24FA53BC4DEFC58198DF8464E66ABD0384FF
                                                                                                                                                              SHA-512:94DFAE6731DC54CBDD81A7D7EFBF44892DE20DEF40E97FB98545CB5BB62E811CC1A1DC8F65A8783B310335314B6B4E908FF02EDEEE20E817F9446CED2954961A
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.4.tn.."..........@....G....s....N@..J....F.d..(........E.Av.T.(...O..%...b.JT...`..$.>..wWM).....h.@.iF#.....&...>..^....Zp...D3.5.:...C...bw. z...X....]i..i<..Zj.O.}S...9s"......g.d......\o"ZJ.........EKZ...&mfGm....J..s..AL...1l../rI.\/.V..........T...u.".O._!.s.<-.=.N.........I...4M)..T?e.a4;(...ng?....x..l.............'..j......u...[.h..s.$....V..'A5...B...E.7\..O&..a....Z..Q............)nU3.t0.2.7..A;..nl..s._N....a.....8@....x.=;.....Eo..@".5MA.d..'.&...\.CrB.#..N.O.*.._.9+=....[.+...ez.9..;..;Fvm*:....!.....M. .>a.....R.(.~......G."...r5.RB.mv...C).x(NfK)S..`E.38'.K+.B...;..B@LX.`$1?./....D,AX...W..M[.A.......j.fmEs.M.* ......dE.......8.K..#..+n ...w.!2.....i%.09A.5...9\.b.....$p.].#.1.z7h(.^.,z.....w...XT.7`t.Se3.<..<..[.... ...w.t."..&.B`O...G~.S...8..K.L.jV.....7...G..2].yl.H..p..}=.p.b.E.a...~..$..4:v5.!9p.>..+g...l.DT...7.."Z.....R.V$.K..i.$#.1.m.}j.#t.)@?(......i-|....n..800..lV.e..h[..2z.....p.z:q..}.y{.1.t...H...Z...RnO.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoIt3_x64_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37310
                                                                                                                                                              Entropy (8bit):7.995179455824013
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:ZecCnkkAnR5olp1wqaotJ8zB4WZ/8laaufPjbVJTxEQOMVD6Kx:knkkAR6jDAzaIqaaGPjbVJlOUJx
                                                                                                                                                              MD5:B3910E9CA7045405D80B3214C599B40A
                                                                                                                                                              SHA1:D788DEBCC82F1C451FAB9D6FFD292E4B22203B1A
                                                                                                                                                              SHA-256:FE65B271FC28160AE3B1E932979AE0A428D7C1C30A42475A44338BFA883E06AA
                                                                                                                                                              SHA-512:900AB6932F4315D6E767541C9829DDF2174978B80AECD9185D8C918A77247E3CA28AEF8D0AB715F5719234A3A7515655D5F5BAFC38FD94B34C82E76E0FF090D8
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:...._..b......{..K._/.......6H9.q.Qr.TB$.2.....q...[..%.c....#.^4A....)s...c.C$'..=.....n<.....j.......I.1u..Lkv.Qwi}I...n...j.l.qX......-Z.--....d...9....P..t..b.g9V.I..es..H...p...N.%.E.HH.O..0Q.Ga.y:........wk...G.....j$.....'..k...GM'..-..}......aJ.~"..(..o...o..P/.......=i.....B...2......y......&...a...Y....|.=....u.m.\.(..L;.3..h./U.f....<....S........$.]@..nK,...D.K..]tZ2..v...L.#-.U./.z0v.i..w:..<.....R...g.f.B4..j5..B0..."...UE..tN.z.si.'_b...*./.1.0v..@V.Lz......wv...^..=yRC.W..{.q<6..kf.,..l..S.3/a@0.....o.. C...`K._..N..P.e...A.B.......D....m{......&.........R.....u....8....f.9...(l?.'....p.|r:.*....; ..N.{=.W.....x7.2....U... .Mp3...N|.g`...|.8Qr...n.......\3.N.&o..A4l....G...&..M...~A....l.,.`.<K...2......i;....R.e...g;....1L.$..A...'.|.........Z...7)..Eg.>.E........,.....V......D...R...H......G...c..l..6.@I...e..k.u.......6..j.......^3.A.....BF..........F...-..)..zX2 m.....u.......>?.Q...J.LyN.p.A.r..|.8K...q"..=..TGxD.=

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoItX_AutoItX_chm.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37309
                                                                                                                                                              Entropy (8bit):7.9952840207008435
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:ReVmJj4BWzaBL5znKl9XpBgfJK+ofSu1Pdk/wZuCymdu3yEtEsLFyRp:cVmJ8sOBLdKfpBYi6SamduPKsJI
                                                                                                                                                              MD5:38C1D90D27AEA1369D87362004931A90
                                                                                                                                                              SHA1:EC802AB4CCCE64F35F5FAA61987BED70DB2C4806
                                                                                                                                                              SHA-256:763E123A88A75D84444363B46CD03AC540598EDDFB024619A92A4950FB5255B9
                                                                                                                                                              SHA-512:ACA3DFCED4CAE3850C0438AE77034602FA54FE22462C6C05C36E8435A8D11A8D4C1DF6C7F4E6BFAC5EB915D770E650F67D5200511E832A1836F101456D6C88A2
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.<5ns..}%(.f.})....`.P#)=.....:.....E...o.'.`hgf=\..j....:+k.>.4P.7.8....}....H..Nd....T.J.w#`.:W.-.L?7.....%e.....B...'..W..t.3f.^E...q.e.).....>..X..P...nf...*b..S....h..lB.,...J[..l..$s..6..]z....k..............jT...Z...Sy.r.R.....NB.<.)P.T......:.. .....K.5T.~u\..=c.A...Rt ...?3.y]:D.:@.,...:..)..x.?I....F..p..&E....(...6..qU.1.dI.._...o;O..............1q`.W8.'.\.P..<..M{1?a..?L;y...!.......j.}.....T9.AV...).....J_..&..U~.6....B.@.b.|I..;$.8..9...j....Y..w..J.[S.....P.!....Y:......].;S?...mP7Sl.1.!.7....V.%.s... ....m .,..R...%..a..{.xW..klA..... .R....v....-.....n.K{]...E..{...\.4....?.}~.."<..An.nu.s.......J8..SW@`P.d][...g.mP.WM..A..-.Q...xv....Td=.....%....I........+........_..#.k^~=>.I.RG.....$.....b..$...C.+.0.k.0.....q..i6.k$x.....w.qd.....0EK$....9.....r'=.....H..m...C.=.X@Z....%..&...u.!."1-'.,.k.u..=~.=.r.....e.B..t....m"....1.0....}*...&x.......&..Ny;...nie..0.I.<c...... A.L.P..1S...).D..jX:..:...k~.k..{=Su.T%..H6F."...h|.85@.-..Ii.nf

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoIt_chm.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37307
                                                                                                                                                              Entropy (8bit):7.99567538687008
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:V57wd1N2p9o3F8J0ei1KEUxjGZbMs9yZep161zjdN4Iq7wqAbnY:j7w92a2JckfGZbh0ZepY9jdmIa/AbY
                                                                                                                                                              MD5:BB1FD15ED66DD54F162B18EB8628A61F
                                                                                                                                                              SHA1:EA54A605F670085BB905AF57EFEAD583AB91E7C0
                                                                                                                                                              SHA-256:27C9B880C41B52774404D1685CDDF0D12415CAA111CEE9D4029192B8D619AD55
                                                                                                                                                              SHA-512:8217030001983278C2A2DF1846F40B65624CDCFB071E3564758A8DFD99EE9721E972B2CA645F5F6BC9EAAB60757927B3203351EFE7955075971129FF65FFFBC1
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:...a.s.....F._[n@...j..@J..9..^.....u.6-.jx.....7........F.....E>..f..9......0..[...Z~...n.#}...m..... ,,....?H..+.S......u!..9..6......<_...vf.<....9..x.nu.#. ..-..Vd..j*..a/...0.|.@...9.........*.~.,...ov.z..9."...\...+..WY.3G..fqY.....S.25.L..?&..%5.>1...A....$!U..;.Y.j..+W...8~.`q...ad.K-..2!.W..M.v.`..I.......r-K0J......}|....\...vDTB..-e.?.......].t...Y~.kgi....K.!..E.\z...8W.8.)U.V\WW....I..!.|..F.,od...L....!...C.../#...4.\..|........_.I...?...........,{....a.Q5K<d../Wxp0.....K@.x..|.?0.c[.....X...!O.;..v..4... .Rn...t<.[...2.......5....a.....).;{..K.T.....9l._.p....@.s._.JK.XU.....&....x..S.~S.../L_..\J.pC ....;X..d..V.k.R.6(s....O.b..m*..<.U..B.....}...qM%..Qe.......(j..JA.W...s.M.....|L....[EK...F.?.P..uI...u...6u..kd..J.=.*T.O2...F.",J.}..`.$>......=...g....4+.?.:...l..k.s..p..-.L.X.....Y..Q.... ...k...#..(,...;...@....P.&.....K.m.h1f.-.........+.f.+..iA...i|.+u#a...(......8-.(F,..$...[.......$a.zU..r.<\.. w2<..=.3.S..h.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Examples.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37315
                                                                                                                                                              Entropy (8bit):7.995220179981509
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:LWTquOT7yUcEK0w2BQVcKxZb5THpvxbFeEWN3hNnlrqV4cEMoQ:LWOfmUcEdwkQV5Zb5jpvxBHQ3h3rqpEa
                                                                                                                                                              MD5:CD4198AD7FB2BEC81D918F923486B036
                                                                                                                                                              SHA1:6E21B3B256AAA28DA16A353CDAD57DEF5ABDE48A
                                                                                                                                                              SHA-256:4D79512E985549397E42E88B907C4481776DA4A4CCC5974B3B4D20A2DB4F7392
                                                                                                                                                              SHA-512:D8ABD6512AE96F26B683CFB4EF1EB658A2AEE7E461795F5F54D2F60E8C682AC7114E220BC5EC9B1B22D65FC2779FDD73CC081338E6D15EEB161D2F304F8B5B78
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.J*..C.....{....j..w.....,&.Q......+..c1.J..'...../.di.S1....2Nb..j.tb.^...y..Op.\..Oyt\....)...}*".1.....4...?..RH.dCU.Y...]2;...._..,M.Q._."..O'......6..9..w...........C1L..;Z.2..0..>.....$60.#&fw....Ck"..M.Vq.~.-T.4=.Xb.qu.%...d.../..L..eS.y_;.....0.;...?..k...n...K..`..{r ..........".Jy...T"yc....\.....E..os.].n4...0.lO....I.....P.....?z.SN.p.R.%..=M..N...|K0....%.^...0"..9..P....xDm.._I.......?.H...Zt%."~..;.b..@].%.../T....e+........1..N..f..-.Wp.<."x}.........D..".97.W..gH..k28.....-9{Iyu.2f>..r|.....1b.ez..W..[.D.d...j..ve..1{.p.a...!tE.Ej...J.$...D~d,......<.`.p/5...+x..../....[......,j%...3].Qc.+.]7.We....>..Uk.IG.+E $*......5../..O...j....O!..\..&YsZ.....]...5....zS^g.z.n........C.Q|h.......T.FZ..#&.#t.....=.A.&.}0.^...O.....m.rd..C=P6.Vv...>.]..O......:....@..d...=.............p3&N.le....u.@..xt..{.Z...4c.l~.6T.5uk...E..&.,..,..fZ.>\d.?...C..c.d.......4FM.M..E.T`%W....O.......0.>.U.P.qP.......d..3....`...\..Z...k....

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Extras.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37309
                                                                                                                                                              Entropy (8bit):7.994790864519941
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:CwIQReYTWnCx7DvLpebBntBs0jN1zzwcql5RIM6bVjkx7F3BPGF:CwIQRnjUBns0B1zzwXl5RIt2JBPU
                                                                                                                                                              MD5:59F990691888D02D8B97CBE565996E33
                                                                                                                                                              SHA1:ADCC976427747BC421FCC362FBC0A8B836FC9EE8
                                                                                                                                                              SHA-256:19010536AC80A0E5138C888FA0A032CBB73792D8AB26964E9DAFBAD82264CA70
                                                                                                                                                              SHA-512:A6AFF908E295EF83D209AC9B32954A5CCA76C13AC681627C6879E723C5F87DDB8671A6466AE6AB3507BA1BFFC7D08C60EA2531C32AFDBC9F37A0DAA36F4EAF4B
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.pz..U....H#.......j.r.....^.X.rs.rP4..E4.....PD..z....[@$.=...9>....2.,..[].. .....Q...xV.j.H....4.G...|...S).wqk.5.....g....Y}....gI.G.f....58...B...w..eS.1h.ng.[.......)R4..3.Mw.......q..g.|?.uAX..$RJRG.bl6...(2..7...=k.........=..t...6..,U...h..E........%....{..8.[.4...w.g..?*._.%.N.4.X>.:.1eQ.Z.;a<Q..[.]m.w_.J..K..L...&.H.h.a...DvwA. ;'.. ...........=..)K....... ..._..3.u...#.2.g.a.}..p.X.....M#Wb.$.%..m..^v..|.J..-...7..;.I..?V)}^..H..*.A.:...R-.'n<..{*..'.._....G...*V.[.RG...1..XU..H......"..b....K....C_..KACJ.....<..4.L.>...Mh.x..o.....c.#.~%......}>.b.[e..n.KEQ.-...Iid...pk....O~D.i.......~..jl.=.Z/.y"..3ad...a.......9+S....`...=...V... 5Y........;.l.f>.t...i..e....TZS...+..:A.C....q.Z....gNX.El.Z-.....oVFa..^{...4a...R.4b.1....!cH...a0Z..j8.U.x...U?...[..gn.C...N<3.7...7.u..2.....-*.h\...<.).P...Y..Z..dy.M'..~^..;Z..e...M._=Q.^H...A..../-..oa...#,d....C.9i.D.....9.g;........v.s....f...J{.A..Q...OA./..`~.......o@...>.Z.......)

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_SciTE_SciTE_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37314
                                                                                                                                                              Entropy (8bit):7.995347751537386
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:vo5RU1jCu6IKGtK5YGeZJWtqNOXOLjzrkxQVWeofNv2WgW:vo5npfGuXoDKwUNvV
                                                                                                                                                              MD5:24CB46A3221FD3AA0AEFBDAC7D53516C
                                                                                                                                                              SHA1:CB23CD87A1A9CD70788BA984738487C03C640795
                                                                                                                                                              SHA-256:75A7859EFDCBBB53931255042CA1129C29A5909A48AC39C4C81DD6C46C23EACC
                                                                                                                                                              SHA-512:D48380BD6278CBA9DFF6347833F8084F46521D5E7F6288CBEE55D8CC79218C06A5A33B0CA4D4E0D4F2FB955ED4B64A9D22D5893E9C35F594A63A266E2D19B597
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:s......a.Q..{$]..B.(....z|P....C.!._t.|I..y...=LS/wT<.7*.......9..KV=..\.7.t.?O..<.B.G.!.4.F.."^....M..jj/.`.L.....=...0.+.=.v|y..z..s...F.x..w...4.s.f.#..r.$.V&..;(...Q.&...0.I0[.k..K..._.cD..q...0...*$f)..~l6.}..x.....$>u..us....^[.i.x....=..Q...J.&...x...G(.oL54..X....?.E.h.Z..]..EE8.2....h..Z%..~r.L@Z..fG.........._..(...m..|...?..".(....qhic..M.)..8X..A.Blx.}.J...F.ON,.....L.e..v..5i$..Z.....qe...YV.k.....`b{.T......PLh...s.D..h....\...j..XK*.d/n.4KwK]..I..9.....y.o......s^.....<./.....u.a.0.66R.....;.%..y.....k..43......=.........d-&.Z{e...U/.....b.......u..=.p<....@..(2.B....'....V.wo);....P..H.C.</::.'.M..... q6..,ajO.3..;..3G....S...E4;^...s).....<:,70. .....h}.m..5h.T.6+1[W.?..OY.<....>Q.p....Sf./M....K]..L.........R>q..._q"db.,...CV...KU.]X.$..P.,,...q.{B<.v....Vr.=P.Q..,).0w\....*z....F.e.Z.a..g.."%..b..X.R.6T;DI.[G.U..0..B.%....i.Y.U..&_.........%..E..~%b.8...i.%SOj%oY......)...O.o..K.l...wF.?...xAK...@*.zUI...o.<a....

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_Java_jre-1_8_bin_javacpl_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37326
                                                                                                                                                              Entropy (8bit):7.994972959119869
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:6kO6m7NpA7QmcV2AU5tvz57EBf8O30RSwHOtbMM0eYrPQHJ6G:6D6U/A7QP2fFF75nRjO2M0DUHJT
                                                                                                                                                              MD5:B80E6159027D6C3D86FAE50B5267012B
                                                                                                                                                              SHA1:E5C05A5ECBAD324698EF66E6929E57CB77FC4FE4
                                                                                                                                                              SHA-256:AE8F73960B1EBAD23EFBEE8BB532B77AA82468C71E102D8E4AB5C4ECACE89965
                                                                                                                                                              SHA-512:7190D21001B563F403C66887A9722EED5F186BDF736CEFD4CD86595A32D291B6F41A3427D942DE06E8688C35D7505F27CB7E3BABC0BB0A308F0F500650E79EFA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.......0p.S.V.U,.p.]...........J../.....G..U...)[#.GS.....E`.R...l...&..1IO....)?6m{[...].!....._..U.$..Z0.LS.I....H.1..np)..Y...+[t...#..j.....F0...n'vsQ.H..=w....c.....$.....u........l!AF:..S..=.r.G..5GL...iY....9S.......*5.6.^.:<......c.....@i^.E.).)...m......h....e.R.(.W..I.. ,...._F...<..t....aCw...fLz...........I..`..&..Z8.b...1P.Y..JSL...............x....%+b'.j...q..@...r."....z=..J7R.......k5g....^...&.q...m........(.......=1.@.....$8__XG(....y..2..F_NsVH......X..).._.o|+Q.....G.G....Z.op.&T.{<..X])...F..7.V..s..3...."a...,................F.K@.@E4......|....c.....x.....wE~..............9uP...R.E.!.[......\.Q...m...*>j!/...].....u...m....._n...M...pr..^.w.......i.8....m..}.).:........<..B......7...D..b^_...;B..M-....9&A..+I.o..l7I.N.l..E......4.l......?.J./QX..HU7>81.])..h... ..+...../........vI....5q.....\.....[B.9_.9.....\.,..Yv..OV.+7...E..s..Y.;.G...:d.V.y*......?;........y....Ak..DQ.Qe...7Px..OsE$......=&......j.J6!w..2.[...!....

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}_WindowsPowerShell_v1_0_PowerShell_ISE_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37336
                                                                                                                                                              Entropy (8bit):7.995609870876434
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:sNq0AtDFHf1EyTvZVmBlx6WFAEQl2OISUTIoDWMLG1TIqu+rSq:0JAZF9zTOBlxzFAeO/UTI1UK1v
                                                                                                                                                              MD5:BEAF9D39AF28DCAB1350F742786F10E2
                                                                                                                                                              SHA1:8D42517B1DADE4AA653FF42C406628F1CD5C4FEE
                                                                                                                                                              SHA-256:46D684E3867A9EAFF2D29CA21B17E2278ABD7EC5C5D5B902FE6CAE543893AE77
                                                                                                                                                              SHA-512:D4EA30F55AA64BA22DE6EDECE648F710D80AA8C8FA9F86D4BE732DBEFE9F817D0459BE884C319A24CD134765AFECF463664C281AED6CE2B14F3CD63319B98031
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:...qV.-g..9.h..HCn.`,..n.IS-....4D....".%.L..T..z...xJ`.u~6. .@W...5.il(.....^*K.}.u..r.j..}uh......!..t{..YJ...[.+..*......"....o..QY8...?..)..Dk..W..!+.W.t....%..z....1<..k........cj..<.......g3..WP..Q.F......$[.#.L....#."Ez..S.....b...`.u..1.P*;.).....Z....L...%..,3...4......|...h.e.=_.b_.Ym[.N..)m.......xvp.p.LBm.{..6.....Q....t.`.R]:.7.W..cL.mI....{....EP...f..t.....- #j8..w.`.....e.b......T.W.....Z.e....KE...,<A(:.....b..<...o........'..>...a.N..l]..w7c<..=...oz.2.0....?s.V..._T`. ......y...F......z.....V....8r..`@..Es7\...c..}....9I...E$h.l..A.[3.........6b..........d...f...U}J?....#....k.4..LWQ_.s.B...I27/...o........B.n.g\....AtZnzNU.....a+...P.dl...^..*....c....|..>e..oW..W.]^\=d..L. ...&...Z.......P?.d.4...*.n?...j..5....WP...%O..~Q5`..w....(2.+.$[..Yt..t...F.a..8.0..CD.N7../rs.ug.....-.............t3....Y.2Q..g.L........<....T..CO...2..MuF..Zn....ft.....6U..@.%)...SV..........SA&d\`....!.3.a.eP......H..4.Dd..D..

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}_WindowsPowerShell_v1_0_powershell_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37334
                                                                                                                                                              Entropy (8bit):7.9950481539426255
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:9nKS4D4nbGoxbK7evhNOJiYs2PHUl7zqEykK7MSf0eCahXTKM:kSqe6kfoi4/GaJ7K6hjKM
                                                                                                                                                              MD5:623F582B2FEFA5AF718BDA708D79EE50
                                                                                                                                                              SHA1:CDA9001A22FCFFEFD8B1434D5A0AB407569E3CC5
                                                                                                                                                              SHA-256:90FBA8B5CEBF202F5D0B5111A6110971A602AA2F41C1BB1A6FEF233493308B49
                                                                                                                                                              SHA-512:6D595C8E41A80505F78D11B1561121EFE9349AA71847CCD2E0440E66376D8E5D21F0723F09366B93DB8F78916B26CEBB2CDC262B45C1E8A8CB292A1F3F64C03E
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:...S..4h.q..e.6@.=....=.>.!.......Q.%x.ip.5...o^Vh.5.m#....c.............sn.[.=aR.e.....P.R!j..OdC~.9.t.^da.[Hx...L.+.....Q1.?.$)8.H.n.:..M......jl.....fX.|i.:.........I9.`.D..i....Ks./e\.%1.......k.......?.}3t...>..^7.r"B.U.......`q...$a..S!....G).- .wp.b.;4.h..e.G...m8.MD;.9..O..oU.....kn.EL...9..Vt.@..4.......Id...$..M..Q........G...Fb.J......{q,IXhM.3......a...../8.......?....k....k..r3...9...Mt....&2...^........m..*D}./..B.f..... .=....]..RN_.n.'6..Mv...._H.%.|..'!2h....>..tg.9........Yp.....H$|....../.`ql.;..bE...O.....(...B/%...P]+...t.z.......C....F.E...~P.d..P.[...@1......Kz..`.B.!.x.....%.wB.mq.\..P..PM....C._..$.s..t.?.....-UR..V=`.).w.....d"YD..,.DXu.P7....6U..bX....Z......5.).....1.jD.!L..?.k?....z5}R..:....Q.....1N.....e.A.....l..w..."I.8._3$....#Xf[.... u..n...,.....dd1.l.H...\..B.L{V....y........{.S,......]j..6....S_.8W...G..._..H.@..r.....m..9X.....a.9.F....V...d4g....Q...Z3ft.y...vR.y.9....o.f..3Q.w..\....

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}_odbcad32_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37309
                                                                                                                                                              Entropy (8bit):7.995455162849902
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:omEjYwb5S0ybnwaU1OAGdxXdm2xQo7/g5hEppMn+nZmvo/0:VaYe5SvbnIOA23m2h/BppM+4D
                                                                                                                                                              MD5:F874447F994B6D6F57FC08E0A049C641
                                                                                                                                                              SHA1:D5089D0CF9303F7D716E3E7A72D935C0DFA6E6BB
                                                                                                                                                              SHA-256:0C9E1FDAEA595BED3F92DC685D68678B0138FE68CABC0A6BF006BDF529A0F709
                                                                                                                                                              SHA-512:787A480D9EBC7191F2EB4C23469C7BB7DC3A1A17B69A1E79726DECAB2F3CFE575D32C8EF36EE815E8228B7417B4A8106D0DCE349A59B8A5B06611BF6A908C7F0
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:...pj(..l.%!..OZ......L..I.D..5Ak.j..YfX...(...H(^....d+q.l....@.=...S..Q.z.s...{......Aw......^..n.P... ....*iu.A.M%PY..Y..T._.U......y.i^..Z.?.o<19H....IzE..N...|>.'4L.P.d........w.......$8..^e..2.vh.G.&.J..s.D=.4..4.^m.m..4a...a...T.=....T...:%t.........D}.....{.7.h..&..1..~@..o....q......P.4..N..hF.......rD....i..tL.l.4.............I\?......*....:.....O...g....$:...Y...3H.[........7.+;.`FT%Z.;....7}.B....}.....i.E.....6...^....mwj.....m".....bNE..#...&...(H."c54..1......k...>...k"M..S..G.!R2[...b].._#.-R.W.D...........W=..@.?...).Tw......t}QE*.P.`.B;....50h....Z..*`....M..5.d..vHJ...w\.O....zqe#...+...*:.].:.....KxF.n.5.u.BSo.r...*.D^s..A>.>..rpN.o.m.5]...k.i.(...#../.U.l..'h#...q..y.EB..(2.A.j.'....W.1H..&....|.F4L..qzh4M/......*-..|..#LY........._.8........8...1...s.t....}7...v.j..O....#.t.[#.Y.c.....k(Y.@^.eX}.z!...:..^.c.b5.H.."E3....+#.*....%..;K.U............W..=...]...?..U.....$..nLW.Su.....$.oH..:.?.9......o.V.A.P.l.Xh...."..

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{F38BF404-1D43-42F2-9305-67DE0B28FC23}_regedit_exe.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37306
                                                                                                                                                              Entropy (8bit):7.99588035336898
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:mes5yMOqhwX3lF69i6htXrgqZufhXlAy0J3K8Z0+2MN2hFYseQpViv:BmOqwVF69lXuJXlAy0QKHxCFW2V6
                                                                                                                                                              MD5:9B9EA76AA1A0DAB8A4069F88B0E5932E
                                                                                                                                                              SHA1:1F295BAFDC55EBA0FC4D18C0954B4FBB16FFE6F0
                                                                                                                                                              SHA-256:3925521F7F8397F8923E570A50477ADADEE3F6AD15F92A9C61C9338B886D6778
                                                                                                                                                              SHA-512:B4CDA8987445F474070C7AB83ECAD247B6AA3C03E562C3DD084B20C82E171D071C85B2269717F762153918BB453AEA3AE14DFA396D65F4EEBB83BD95D0EBF125
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:%.KjT.0.|.....Y....%E..z..Mg0.V#q.kP....x..m.....<.........X).....l.j).$.8.{....z......p..~.{..0..j.....w...P6...sR.f..<.8.'..._..6*...1.OY.P..u.p...Sd..&....y..,.Rh|........z......}.@..bJJ....;.Ffx....%..<...P..X.73.&..N.3..........C8.V).V.F..........G{pg .....EU....i...T.._.<Gq....9.[.@..uJ.K...fW...jGQ.&....'..eG..9z.)m*.P.{A=..H].z#L...0.i./dy..[.;o.p.8...AN.k...Fv..h.V.n!...^.h.].....G..*?..7...bR.|.RS"I...c..bflJ...F....>.....B..'...P.u....F.^.y..B.[.ku....O^h.....K...'.-..?.h.f+......22..:4.)P.x..^....ib2bL......P..= ....2.WE...v..8U\.O..f...V..2~$g].ec]...,......\_.v.<.x.|.!..dh/[.....V.....'....o.I.R.f.Cwb......\Hm{.Z.+Wm.....4...&.;..%nq...Dk1cE.TUP{..a#.h`..@.....m:......FB..>... %.....p...fyG1A...,#].%.....U.9......r5^.b..~......J...^....N-..'..$...l<?..}n.q.......g.`.1...3.....K. Ak.C.......TK`j.G..>,.yoJ...2.{..p...d....}.)_.B?.F..`...j..c/..)...H..........D.#`I?.....A.s.........4unj).l.H.c..-..{.(.Z.i..{&....(.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\0.0.filtertrie.intermediate.txt.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37712
                                                                                                                                                              Entropy (8bit):7.99520562393644
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:z/oi06JvQny6GvWbsZfZwawf+1EzeRvtGkMP5zrcdlWDBUBrdMH3agp:Ui2/GOsZCawf+WwWP5zrZDB+raKgp
                                                                                                                                                              MD5:13F9761295A7AD117F4E0363F91ED0B9
                                                                                                                                                              SHA1:7DF9DFC9D71EBE9F5E43DDE7C0A16A1F5FDBB796
                                                                                                                                                              SHA-256:2F36A8D6371F27344D557A420B8315B1083740187CEFBD52662DBA0ADD329738
                                                                                                                                                              SHA-512:396C7BA22411DC770BFB1F8E18EB0D8178DFFF7CC6D5344ABB9E9A8D114FBE2FA198E435053D9D30A62EE8421DAE1C130A18F525499E0CD050EF4EEE26215B4E
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:...b.CmQ4r#!W.B..u.}dk..<.rF.*...U.f%8.0....r..0.^*NH. .P.wOEDM40..Df.{.v....j.&.g.s....,7....b....m&%...k..e.fB#\'..#.t2.....T.GZ$....h.....L...Fh......8c.....j8C..W.....&./`'C..uj.T.jM|...o......o.A5.x...un.h{...Iw....f...[%.Vm...5..9.*1."...So.l..H.0.0.5....#......w.......^.+.@..O....k..Cp...l..4.....@..3.B04A.R.|.5w.5..q....p.......s...j.b.}.Dk.P.Nzy[...zY.p..#....M|.W~kcU....N....A;..o.q..|.9.;.H..-..Cc.{.'I$).._.(m...'....2..q...f..-f.c..P5..;..1....M...a?H.......1o<.LHFfE.y-ok.3K.....:.>M#.I.ce.?.L.P@.I.X...OD44'c...../.:....$.Q.q)O.?.=A.]z.(..{.5...J./,..[..W...Y.q.8........l.....G.;...jaP.(a..........L..@..L0fm#qt...WR.<..=O.....OiK.Gu..%...$[..z.z.g..r...n.7h....F...`.;fD..`yn..@...O&...."%.....}..qyR&s.....i..........|.61z....N.uS..{.........<.%r..K..w.ZfvBQd..i..i...$.~..:...V.0..B.q.)..eb.ud.Gu..M.z..4....a*...&....t.rx{.!..b..+.. ^..H1-...A.I8..Z.-"...].zw$.b.......6...Ry....)T..nk..0...p....Sv].zJU1.Z..,p..aH.b.... ...d.c..

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\0.1.filtertrie.intermediate.txt.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):264
                                                                                                                                                              Entropy (8bit):7.1037993049942765
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:6ToLG72rLnN66DxwESIc7I1EKcgsScMMUnK9Y240pD:6TxeLnN8EDcs1Ec3O
                                                                                                                                                              MD5:0D7663C37E261F3B345CD82168ED6020
                                                                                                                                                              SHA1:035679E91356E7A207724309F4304E0B622A0CA1
                                                                                                                                                              SHA-256:E4B1F2E21BEB7BD1A2E71B886B78D56A19BD6616C7FBC1AA7F1DBDCB3899BE5A
                                                                                                                                                              SHA-512:276901FE2CF7024BD3D8E4C17F9C7B3F4BE478E572E4BE4D070CC06F316DDBC7533DBE15CB2FB8DB0BBBF5023B03C495CB76E9F8C0B12D9471CE59B6889EDA0B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:Q.hV.z9..u../l..g...9...;...8...-.......zzt.I.wo....5-Q..,.....]..P.9m../...7.9...K.......(...D..adQy....z.Sw. 39`.2^g...f}..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\0.2.filtertrie.intermediate.txt.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):264
                                                                                                                                                              Entropy (8bit):7.056241893774795
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:BoLG72rLn/M+bIM3qlzKcgsScMMUnK9Y240pD:BxeLnU+bI8Ac3O
                                                                                                                                                              MD5:69CE0663EBDFBD61989EF185762AB4F5
                                                                                                                                                              SHA1:01259C62FD61B9668AB909F68E03D4514E88E0EC
                                                                                                                                                              SHA-256:05307365CA6F15BDAE1F4E8296A7F8AEB0F9D28E547D5297948B5A07CE6BDFC9
                                                                                                                                                              SHA-512:E9ACE7F772B7B4091060007080125EEE7EA0E00DDEEAFDFD03D51D7EDA483B0A63B8835DF78A6091E90585D7BDC32E8F917CABE5875560F7D1C1B4FD713CDA98
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..#tz9..v../l..g...9...;...8...-.......zzt.I.wo....5-Q..,...**.........:A@...\.v..o.D.".......N ......6....@.UI(.84.RY~u}..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\Apps.ft.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):50651
                                                                                                                                                              Entropy (8bit):7.996301672809033
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:bk//+7I3iMEIVyfS51NYt1C+bpfSQqsid29RlctGinQESFIFmuVwOOtyu0d9lB+5:bQ/l2I8SzKnbJRpe2FhwItL6+NARo
                                                                                                                                                              MD5:216BBD363C7EFEE7939DF388DDF412F7
                                                                                                                                                              SHA1:F38FF3AA879B8C0EEB28E0D59654CCCD96DEB7E5
                                                                                                                                                              SHA-256:F6521AC983246079F94C93FA875B4D19F7C158C44929011093E85D623EA41DBB
                                                                                                                                                              SHA-512:A35BD0E1E64D15CB13DB4A86D8127061A262ABB1E940EBAACE3C72C942D3EE61E2652FFF85D546EF7C663AA56BD1E8E69BE3019BD2A296E267C8B09D95FA26AD
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:g.G...F.d.`.v.T.;O._."....\...=.0f/.@.=!..3..Q.`p.f.*..teW..."......&.%E.n.(...,3.....g.N.e1?.eV.B..2Aa/F.#.s;..X.i.iW....k.....8j"...|.?....e..p.O....E$...x.4.v.....=.ac...O..3.kD.....X..P...(.:.n...u..)...8.....w=.!..q...P{.;2-..9}l.q....>..H.....+.V..8E<.s..ij..8....iV5O.v..[.SrG.>(....*.rQ..[..&......h".e..Y4..!...<......-.v..@4........|......`.S.....f.-.d5O/.2...Q.B].`..../gQ$.C...b;..Y.^.......Rn`.g!-.......`.4.........hZ+|...?.5!UYD7._w.N..#I..~..../...wf...h...Q...(6.*F.T^x!....Gb:...ud.uS...9.9....@..u.m..WR/b.zkw.J...C.*....k..xQ2tB5.....$OH._...?..kJ./w.&]....-"...).s_.,..1.y..^L.f.|.(.0.q"........aE...Ba.o..%.....DS..~......+6.-..r.|......K.w./..z...@.F.t/..l.F.32..'...=:..j2.i..x.o....p..7).......B.J.@....F..~n.....3'..C;#.3...G@r#L/......i...y...."R..b..<L."WC.............[.I........h.p^... ..J..G"e..0Y.A.).<mv.\....s...IE.w..np..!.O.q...._.;g[/+.*..#..|.4.T...(...Y)1..&<.:3Y..!J.2..#....l...@R.b.)i.V.Wq...9B..thC(

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\Apps.index.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1126615
                                                                                                                                                              Entropy (8bit):7.208751585025868
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24576:8w4IUoxwFXDIm4g0qeuhjbr7YfoyFxz8GHxUM/:8TSyxImYuhHwf1xz8GRz
                                                                                                                                                              MD5:6FF39A82394935FE3A629561778820F0
                                                                                                                                                              SHA1:14F88E00ED23A49F95AE803F925D94BACEE684B5
                                                                                                                                                              SHA-256:D700D9845D283CCB26E9DA4AF8B22DB03FE6212AD1E2CE2229DC1DD362F3A23C
                                                                                                                                                              SHA-512:522C70FB976019A7A59B319E0FBD0FE1F09E4968B2067DE01A5CFD3769DA7F64CA64BDB0F124FD864A87311F6DC5CF55ECB1F5B72CA0B38FC1DB6FEF5B3BDFD2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:./up4u.~M..1B.]Q..b!>...&b".v8...7.AU.2...+Bd..7V...(*p.[..h..d.W.h..;..`.blt...oGl.....+|..`+h.X.Gv....A.~...+...w.U..X.....i<Gja.M...oC.j.@.B....sxN2;.....r.!..Ji....Q.[&;..aG.].[v..F9H\=.S"E.Wy...HD2.K........ :s%..C@r..))...Wd..r....4..>...J>y.]v..g..-....G..U....c.p......V..eX_...B....L...#xS.pl....<VFD[......-6..-g..7.lT.t.g..J..k......2k.!.\..w..$...[Uw.N.........+.....F...'......QX..h..cu...)V.....8...~&.:=vW.XG..Q^....$..tM.g..6.."."m..E..l.."....1..6...>.*..u.z.......y.ZjS.7vL.U0 N....v...9...;.T........^..W..b...A.n....pl2.;j.....Z)....V.E.(O.5&.....Wp.<E.E.Rf.eO...g9.i.n{.Z..%.....(8'..Z?L.)e.}..Y|..EV.C.n.3.D>38.27..>!.{.<.e.*....7...]c..3.G....4.....w!....f.X.a..9E|...Uo."=...w/;..?.W.........3..:.....1....F...U...y..K..G..'.rO..p......-b.....qXe#O......:...K'..J.k....-.B....`.~...VH.N..MP.Y.0.?.....0....o..fba......b.jo.7.].k.;.}'..{.6S.>...f5....6...'o.7Z0..S,......6.c...b$.......V...J.G.y.O..i.....3..Kp.....X.........r.J

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c58f7468-b990-418e-a4ba-ca3568b01c70}\0.0.filtertrie.intermediate.txt.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37679
                                                                                                                                                              Entropy (8bit):7.995194182332784
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:AfnQEKpYX4dJQTcyYon5P0RPRcj6oiYDbj8f9TRgZWhyyE5/SpQC:Af+KXCJnoSRPu/iYDbofN+QEQ7
                                                                                                                                                              MD5:28BAFBA6F5283AE063617359ACE7DE5C
                                                                                                                                                              SHA1:BD269C5405C46527ACE267C980BB37E4AF53241D
                                                                                                                                                              SHA-256:5ABDBCEEEA0D11D06A47BA1373687FC4D07C7DFDFA5DE9F78AA80658C1A46546
                                                                                                                                                              SHA-512:424CE57B641D89FC24CC46C4DB6465CC0AA55099450C12223225DC7BD437EE30E40DD7D5B5BB687DE34627A93A19F3FAA98E04B93EB7BCB9AF016F64987A70C6
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..C.GA.R....{.n..."..4.`v.....:=.Q.M.~FL.i.U......C.3..%..Q../.|.....<..=.x...A.).;.R......5...aQ.~.P.ER.....{}...Az..Q1.j._....4{?fv.X..9...5D...su$n;.......3K..t...n.mz...........p.M......m..N..1..(...I.....ge3.0.....:8.W.P'&..uw...r.^-..l.....r..W....N$`.N.....N3..u.U..@.b......>..#..TL........z.'4..qX.. .....5.. b.(..4..:R.....b..5bM..8..it...6...`...e...4..'...@...s..8....r.....`.k5.Ja@....N.[Z(M..,F^iH..[m............Q..P.k..Jh.99+.X....].bh.....'.P.P%T{G]jp....nr@..)....A.9i.8@..t../....|..8.U...h.q..Y.M..D.D......m.:.*0.....[q.x.....R.....J...Z..n.b..Le1^...$.........-.7.MvN..y...p....a+Xz1xi.$._K.v.QWq.......w.e.!.H.*...K....y.....I.I.`.....19.~..6.hIB>.[.pF..../.&..).V.9.4..A......Y|@..z._V.}?.6..9.{..K.Y8.&V..!...W..D....'.6#.i....Z.>I....P\.5.>/....N.].$l.A?..!.."W..G......^U..c.uBk.6...S.."a.8._.....C..H.mM.F(X*."N.bK.....T...........hj.R..!..S\..*!.By..*..B.......>9.|....8.w.....=....f..`2._..;.....c.......|..*kL`...&s..w.J.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c58f7468-b990-418e-a4ba-ca3568b01c70}\0.1.filtertrie.intermediate.txt.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):264
                                                                                                                                                              Entropy (8bit):7.053628424320655
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:yW/oLG72rLnZbljiaXsfsMZiKcgsScMMUnK9Y240pD:ysxeLnZhZsMc3O
                                                                                                                                                              MD5:D5CD757EC859BC73A0CAADEBABA5654F
                                                                                                                                                              SHA1:3FCAE07675837204E2D443B062F2A9A852D9F589
                                                                                                                                                              SHA-256:8D1BEB8C7CA9E0FE576775D3FB358BBDBAEF22C99F4A24DF9806929EFA8DFB8F
                                                                                                                                                              SHA-512:C2D93AC8C7BF8E931A83AA2209D0C6F4E9A0AF5B9D36D04094ACF197B70E790402190D50EB8ED285B6B33577D22456C7AC6CB07C5498AA91CBB0164297BF21C4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2.BkTz9..u../l..g...9...;...8...-.......zzt.I.wo....5-Q..,......}.t.."@....$.....8.br.h.v%.....U.w..D....5Y..Mc72j.h.k.Y.:..}..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c58f7468-b990-418e-a4ba-ca3568b01c70}\0.2.filtertrie.intermediate.txt.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):264
                                                                                                                                                              Entropy (8bit):7.086008145857839
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:OKroLG72rLnnnOoAmdoY0r0KcgsScMMUnK9Y240pD:OGxeLnnOuuY/c3O
                                                                                                                                                              MD5:68BA0F378075CEE76C64E5A46E3980D8
                                                                                                                                                              SHA1:9FC6ED368ECA714CCCAF7457B900B4CA8BF4EEB1
                                                                                                                                                              SHA-256:57226ED242444D945CF82EB3D6F8BDE75087728EBDFAB36BDA4EF29951BD8151
                                                                                                                                                              SHA-512:0CF2D2008E3C4C80CD32BF6E3DCBA780CE5700133643596C53A0707D461D450FBFC68D8F7C4890AA8902CDE1FC61C611F5E41572899937FEA2FB8EE98E6AB949
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:LY.7.z9..v../l..g...9...;...8...-.......zzt.I.wo....5-Q..,...$....0..K.K..a..h.-..8....,.d7.eV.:-.-.,`..J.!..K).o...0,...\.}..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c58f7468-b990-418e-a4ba-ca3568b01c70}\Apps.ft.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:OpenPGP Public Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):50605
                                                                                                                                                              Entropy (8bit):7.99571821977759
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:bfD6qkxQwoGQlP2r1ph41GPwOUcm4g8vSNHskU/JvEFioG6Zx4LyUAiAtmp4MLL8:TDMeQ+qiGUcmivqUBvEVlImRtmpP/y
                                                                                                                                                              MD5:2DBC1C1C54F3DF13387E68FCFFC2A86E
                                                                                                                                                              SHA1:A251835E485C5EC841F549CEA7A23ED7FD435838
                                                                                                                                                              SHA-256:136911619BC0CCA4E179A393C878F1169BEA953DF9D260A0C35D0CF1BEE383D5
                                                                                                                                                              SHA-512:1572C2A8DADE3CF805591DDFC29CF173AD1624CFB241AA7657EEED74E4D287F37AA3CAB7DF48E69AC456A40BFFF477E86D2CC1420956DB08F67922A57C303C87
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:...7....h.S\.u,.........,...2....\. P..8..E....5D..B.b`aI..h..g....-.s...Z..>.,9.o...&...t..ba.....O.+..'..ag..U.f.....b.b..7...=/.96w.h .....\....Q......[{..M.6rZ-3...M.(.z..>R.~X71...... ..yL..l..p{...=X.B.,e.K.v...z>...Gq.g.f.^gq..Q.....w"j...x..&m.....|...4.p.4cy.Z.D8.9.....1.....V...........m...........w.2M@n}.8.T..{y0OD..H._...pa...!....J.5.C?.An..U.....J.z*.*..O..u#.!......NB..h....M...z7ZN...P.Xp....B.$%..r..&.!...Kg."..v.l!......e4u2..s..|B.;..P...m..m....r..(.'.=.?..z,..g9 ...ST..To....k..V.'dwV.a..dPKl...`"......f}.d.....&.;.>.._..MYPL..~.t..+.d8...#.... g...qgy.+JKx.i.._.t...L.....LZ>..o.....@.Z......v..6..@!.L$^.nd ..,~e..^...%..J..9...4=..N.r6.N;.*e%H...?....$!.....=?..~....=/....8...X0bV./....._J..g.ck...q^..R.<.:..?......6[2z.]...on.4.}.a...h|..;..h8...2..|7\......"X.0. ..J.(...+.kO.*...7...G../...'...K.Z.W.V....15v..]...W.?u#.Ji..V._xQ....7.z..M...... .....p-..#.L.i:.;Ot...;.....^:..E..C...9.P..u.Gr...p....(.V..{..X....

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c58f7468-b990-418e-a4ba-ca3568b01c70}\Apps.index.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1126244
                                                                                                                                                              Entropy (8bit):7.209032834614105
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24576:fInxWm9biL1k0/c+vatTrOdr7YfoyFxz8G21it3:fmxWybAkR+COwf1xz8G2K
                                                                                                                                                              MD5:9910AF4717BC9257C024BF33A6D83F29
                                                                                                                                                              SHA1:2CF60D6F2749C98611C346F72C05BEECD683555E
                                                                                                                                                              SHA-256:1B1CA0C505A2E94F219F8F392E6C558315C915A0DD72313A3E098CD0AA4DD77E
                                                                                                                                                              SHA-512:5AB098E04F7CBC7F4DB105DFEE7493B5E96BD2A6DCEB15444300E8C7FC6C1EB37C52AF0D0631322FBBB2B97B014118FCFD7DA586D19E9123B27B42A6ABEDB3F6
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:;..-S.-..B..r@.3.#..+...`.....0..5....A..k...R...J4....b4u......."......F.Zp8..6.q......,..bxe...j...a._g.y..*../.s,..\.%.t....^..."...e....qb..h.2...T....y......0.d.2..."..h{...p!h..!.'I..5..u...2.....-.J*.f..N5.t...U.F^...?..v.&.V1...!7/...G......r.MU..V.j.lR....*...CV..&.....c.&....!$...9...ekQt..`.P..,v.6.].s.8.[.D.r.L...C.<,....NU(.P.j...V....}..GLn_....c.....!.2.-.....Y.".[s}.lw.>.6..ix|y...u.A(N._r..Fs.L...Xd\...@.]...+`.(f..%t.Y.AO....|...R..6..om=Ej.<.o..e.``'X...Q..p#......K\C$.4...-.M.K+Zz6.Vm.'..e.6^.VM.A.WF..:=C..iIX[..i(..Q.4#..O<.........yh;.FX.#?.w....-i........&DW..\jAp....'.....4_..2*._..H2.y-..&v.Y..<.e\......%..M.E=..2rKd.h....Z.5}...N.0.........5X.[..jP..b...!wt......*.....;P_....aAzQ..)J..O3,..HF.m%..A..;0.e..K...e.....9...u.,.M..Y.`..9.M.........x.e<......H.N...... 7.F.$...ae..P.z..md...S..!K...Q{...PQ.*...."..P!..k..k}....|~7 .s.Q.m..pq[$......O....i......8.b...\.`N{....]t.?.(g.".Gt.i...~5....Y5.gd.,..D...

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c58f7468-b990-418e-a4ba-ca3568b01c70}\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\apps.csg.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):676
                                                                                                                                                              Entropy (8bit):7.639799351215996
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:e5YtpfjgDUXkMUgwFhoQ6aa99QDMc8o2oQ58dJVJokorE4BF0pZXjw3O:e6gUkJgwQpQDMcdjn75Yfj0rw+
                                                                                                                                                              MD5:80BA64553F3B604C9BFC80C4B0923102
                                                                                                                                                              SHA1:7CF94961188E1D8AE9FAEE13A0DBC32083C86F4E
                                                                                                                                                              SHA-256:690398D72E9F7DC2D933D9A9BBC4AF1E31C06BDF9254DD7553865C968D75668A
                                                                                                                                                              SHA-512:8A14211583622D2E8E637BFA9CB115A976B3D17E783D9B4DBFB99E837701AA83C457D138ED00B5554032F1FE1812585EE793154BBD41FDFC26ED0543D59961D6
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:%./1.....!W.5..'.....Aj1...".n.w..%.}.....y.4...Y!.5..(....>R.....4...,......r.r.'v.1....z....fA..U...e...b....g+.3...9..........Y......AF........Yh.1.W>T&..w......(h3k..O....\o.(.p...9.q....U.....q.....{w7.j@.Bw.....<s..:..5 .....TU..v..C......p...w"B...%A...s.v.u+.....Dg2A..x?@l.|V..7..X.r"w.... ............vg.....J.......:...6.=`.......Oq.g.<. .1.9.|...l."E>,./BK7..E...k6.....4...]...O-.N...7.G.pp..Twts;._...8+9..AJ.gn..l>W..K.-+&...cw...#.$..w<^.....q...1.R..7..5.!..+....]y<.....s$.t.:l.{.:.@:.%.J.&..U.b..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\apps.schema.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):387
                                                                                                                                                              Entropy (8bit):7.477947484817885
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:X1v2S+5xz1ZyG3M/LebcxIB02PRpMH2i+KcgsScMMUnK9Y240pD:FN+5x7zWLelB/Rp42Xc3O
                                                                                                                                                              MD5:451538BC11B942D19A187C12884DDF1D
                                                                                                                                                              SHA1:6105135888280ABA706C2C9D512E809E8469FE78
                                                                                                                                                              SHA-256:87C7CEBA86CA0D7A445A96C63313BE4F6CC6DB09BA1110830DF6D95401A8276F
                                                                                                                                                              SHA-512:9CBB463AC75BE29784972F079CEDD46CF864A411E367BD266D2BFF8BC4D08DFF8BADEE6E2150D70DA6C301A27F3E17CA3736B98158220700C68C62B721BA400C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:A.....rpjV....'..$>.1H.I..|0_Y.C5.tjw_.~....P.z.....Zf.U.n...^..T.*pzbeo...<*.9Y..i...1+.......|'..U.P..l..$C..[.=.X..R.......".:.@{.O.6...R.?.+9..AJ.gk.yc?.,.j../y3...1t... .$.t..i.Yd.n..=B.n...D......E.O]g..vw.M...R..r...\I..S.)l@..%....._Og..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appsconversions.txt.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1426150
                                                                                                                                                              Entropy (8bit):6.588864799957336
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24576:7eXno25Lnn88Hksd2HVEdr9yEKzC79ufKZDXkmn63mlDEyjMH:Oo25L5ksd21eD4f
                                                                                                                                                              MD5:047EF9D1DDE38E0EFA340A4534948E02
                                                                                                                                                              SHA1:F8CCB8C6409C4A831B41DE692129F3D631D760CC
                                                                                                                                                              SHA-256:9F92D0552141514808F27F075F189E282117B66CA8233C2517EA31C24EB5D715
                                                                                                                                                              SHA-512:6C0C3FB8BC173CDFE08A945F4226C61F3DF09D48A3AE932E82F770573DD7E6E624D6D80650EE2C08AE954699EE31F610D9234F290800FC01C82A88AE8FD6EFF2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..+'l.n6.eR..i..h....4.m.R.thP...#I.........].....IW.Ml..@.>......6v.;*.....EF...z.....w....b....c...P.T....\.%.%.l.....2..]*..Zp...b.m...N,E.CF.8...H^"....&.d...H....b.....aL7Hy.bj...alf......~]..q...w..]....j.2.:...9gP..Yn.N.71fh.`.3...._.....sS.E...y8..qD..Y.=.w!..]Y.(Z7'.....QY.g.r.....I.H...z=...R.7..tsi.0R9.[.pZ.jS...d_.W=ws.>*..@.2...i.M....v7.......g..j-.3........*]..HW..I..v._4i.T..^.D<[j.J..Q...2e..H...8.h.T.......{...4..=....X...N.9.*./...E..........m`..A#....K.\..$jxQ..j...s...#./.J..0G..K(.k!...~?.mp...+..1.jh.W).......~.....q..I..3.w..........v...i..c..p.#..n0...p....v...k{.....P.;....|..u..#...._.....a+yJ..G.....[.b<...j.......u......l.|..p..#4.I...0+E.. O......I.!.....+....x...z.U.z.Y[.l_i..:E.......y.E..4..EX.oO.$-.96#..*A.6..a......%MrW7..L......9D...;.oG`.....0..7..>{e...........oJ.....1D.....".\..i..1I......../6A..l..F..k.Z.U7.f0....5.a..c.k.4............`.........!.^.]...w.k{Ae...^)......kV.&d.#..?(.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appsglobals.txt.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):351972
                                                                                                                                                              Entropy (8bit):7.999465535553123
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:6144:9QbhOP7xu7ygPMgy8nipZIxVC/G5CZIPck/esFcMBnJbH6sik:9QbhOjx4yBgtiLQPIZ7RXwKk
                                                                                                                                                              MD5:D2E66D91201E7AC2435D174913EC49A8
                                                                                                                                                              SHA1:46F20281AF96FCC3CD0A8C277559503F0D121518
                                                                                                                                                              SHA-256:A26F06C80DF05B8E5F0B84DE39A6FB99646C10A0FA80C7171EB5824702008900
                                                                                                                                                              SHA-512:D86032DEA227AA5A4D527803C6DC6DCF6D363CF044C35719E5B88BBCD148A112FFEB6569B4E06E77C3934A1F55CC8E75A229F1C21211D04646259C2517C2737B
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:{3>o.y.C...8(..mr6.W:..7r..a..h\..*..GU]:.........T.l.J4.i.D.l.pe...YS.'V......}.L0....H..+.&.&....&e.....1?.,"...N..`.S...ZLZF.T...R.a...+*j...euEx4....*..=~Gp.M.'..th....R.p&.......s.B.<!E..|..J..-#....H...sT>l^?.......R...2...1C.*...K.y._+.W.qXj..Fh\.aR7.6YTB)....lS..[.N&..e.$.D.55...c..n..@.._M.R.....p.`...5...bw....6.^..M...L^.{bV...x.{..f..o...v.{D..2.o.+.eC.'].B.....}] ;.$?E..w.@.}....p........?..l...bI.8..U,...._6k.A.N...L........X..._....73..(._.v..?&...x...~.....i.o./7L.2.l0.....9....M.}5.k...Gz.0v..l,.2.[=....@{N;<...5.x.ju...6I{H.O.BS.<r.f.......i..x.."..&...Izq../.. ..'".........E..Ma...)4el.g>P..x.XI.E.F......a........e1.O.<....l..0.v...W..V.n.....@.5Z...).5%.l..q..3..k.j0..j......@o.E.D.Z.....|"..B..W.~..h3.7....\+_..D"1.J...=V.Z..-.\".`...-Y.l.[u.1..*..~%X....[7.............H.....<O.O.%S...J .iB(a..1..].j1...y..42...nj.......O.........B...|.i.|.\.+...a..=..`WX........l.E...<......P...g.I........d.M...Z....{.K.8......

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appssynonyms.txt.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):243736
                                                                                                                                                              Entropy (8bit):7.999264753231518
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:6144:W727WTdk3LlFMEcCx38t8bYIJFjMhcQxsiRSIGQ:xeI/LHx38t8cIbwR7
                                                                                                                                                              MD5:23FE8ED97AA816351290CEDF557F374C
                                                                                                                                                              SHA1:7D7FAD1D13E30B4487336BFBA71AC30707D7D967
                                                                                                                                                              SHA-256:751A6E35E5520D375ABE939F5572E08F09374614B01809D050DABDAFC7E6C199
                                                                                                                                                              SHA-512:369AA87BCC8FF9D5EA46E52E6E265D9E2BAFE472E3D355AD5B4612BE718F2A67587EDA0D5DC206957A7757F62F9AE6A313D5117816223EF1C89A977C92DB6B04
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:z.<.ZC&S).<...#..<~.H....0.7e.%...D.4th.md.a.F.....5/.).f...?Us3...>.....)1..A.wg_.ri.;+.....p=..6.(.C.....s~Z....UQ.\d..1X...v..D.....3.G\.c.t+.y..66"..5...I..G.._q...m..(.0.|,...EB...+D..l. ..bh..X...d..#..c....!...uF.@.....(...f...+......8.....x...|B.x8D.0..QdC..D.%|"$....o7.=(.UG.).L<*.......7_.gw%n...+(.{p....4j.0'X...3Jq4h.IY.%'p.\.{.a.--%.9V(?G..PA.O#..zth/..o.n(...q..s....<.g;3N..dh......v.W.4.$.yj......:.V....]......W..F...[G....E...8....$A&G...~a..?.l...j.....A.........F.;....-....H......|.Mu.N=.'$....V.......d....]...r....D8.".....B%........<..r.t.%o..&......1`.)..M.2..F...7..........n.q0..J...i..1.L......QW.T......T..9..3(..jU}.Ge._..-b.U~..W.f.. \+.E......{.U.c......8JX.m..........~.=r.!;0.u.n..d.F..+^..~...t.7..?.E.....bM.......A5U..a.%.8e.WW.......".Z..0..RPJ.._].w.P.....:B2T.........s..v..G.[7Q...:%..@.+h.7Qc...r...6.....;t.?.$H?. K.#...HeQ+ZA.5...q...k&.E....53g..a._....;p..|...8.v..&..<z;.*%...K<4..z..2....C.....I.....=.._f..

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settings.csg.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):693
                                                                                                                                                              Entropy (8bit):7.696984192440485
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:ZHGVg+CVq8ttNGVGfnqvHHGGgG0MrKyMGbMxDxHWvg8fO+kL3O:ZmuhttNGGqvHrgG0UPMNBWv9OT+
                                                                                                                                                              MD5:9BA9EFAC69F4E509480F14034E6DA95B
                                                                                                                                                              SHA1:276E6B28E855F25C2568278DF1CD8D3721BA45B7
                                                                                                                                                              SHA-256:AE3A4DA0D6EAF316E0E05FB2893F592E2117CC3E0D331FBA16B2696C77885022
                                                                                                                                                              SHA-512:A85D55715967B5A94CDCE12FF1398C576D59E419D30211B9705B1F08F0C4EF9506175BBE7C9B767862E136AA694A4FF8D72F0207CFDBAB55BCD8D6C963055611
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:'\..m~._..\..C6..=..kC!6s...'.:a[......+e.{.B...R..z........6.-nZ.Q..m.dUgX}T.&...&+.....?..Ca..Pe..=..A0.Q....X...Q.X.TJ...*..A9..$)=..j..N..r6.m!,....u5..f..i.b6V..q......_O.C.%="......Abi..D:.....D.<J.........2....y..,+../ ..)..).....~..+..J.-.P..c..l..h".........\M......2...........j...OAHJ.|.......w.&.`...r..s....i..P~......W.......s..r..>'..j.d..8....e.&.:....Xa._.k..l/.y.."Q.{..)/..;..^|C.s2...6.....@.j..?.y.f..u=*..E...R..4.99..0.. l..l...A...9{....ct... .$.t..i...6..g.~"^....Tw....kQ ..H.0....a...+S...6:%.]4.i...*.9.[...i..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settings.schema.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):406
                                                                                                                                                              Entropy (8bit):7.422451743791116
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:02Pv9NvLmVLDKL0JFfNOIVbI6iRAbRyH+XjLFcgsScMMUnK9Y240pD:/X6E0pO+bVuURyH+Xjv3O
                                                                                                                                                              MD5:37ECF89782FB174E5D6E34E57DC7196E
                                                                                                                                                              SHA1:58268E2237C873A1ABABE55E177A07923B07FFC5
                                                                                                                                                              SHA-256:40983298CF6B80BA2F8758794BAAA1443B173E57BD9F846034934F00467BE2CD
                                                                                                                                                              SHA-512:0120707935E6078951DC0D1B33E0E2EBA0BA2BE635F2BEC165572ED26A5EC0CB00BB2C68EFF3E7E951EDF041D5CD4A2B46BEAB24416684222A27BFA340B3C5F9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.@.X..._.:..Jr...J...O..sS...SB.../.!~....B..U.z.7.......7..@.............CM#...|#.......t].Bo.k.F..G8....8R......7...o...........k".v...y.Oqs..,....gA.99..0.. l..l.....(.ETK....v... .v.t..j..xw.I..<.......2J..G....;..../.fr/....%J..M.....o......j.....jja..%.On..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingsconversions.txt.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:OpenPGP Public Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):533001
                                                                                                                                                              Entropy (8bit):7.997511250684281
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:12288:LRWkVtlVB6KpHwyh07uGjk4CoM5mKc9lD8hC2:LoYlVQKpj4kFoIpGYC2
                                                                                                                                                              MD5:BB57C73B4701AEE758773304AA977D72
                                                                                                                                                              SHA1:E8251C85A8A5A6857F36B5E5007FE118A36CEEA1
                                                                                                                                                              SHA-256:F90C01EEF6921BEDA7D24FEE2285C01F83DD7AFA3CDD383AD8B3A59FBB7D868B
                                                                                                                                                              SHA-512:33DFCA20771AB25B43F9A7E40E8204A788CC8C16899E2CD7C6F05216D52752DE967A8B07DF49814260EB2006DA8C59DC855DF762356AE688C2AD8DD75DCC851D
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.......A.!X?a..........=.|...'R..#Kc.Y.<.S...S z.(x..N.jh...~<.....MemJ...]..,.w%..!....BA%..2...z.s....e..=....c.....e*..o...Bk.iozc.?..m...3.:yQ..^L9f.2.i^...G..vG....^........_c.)z.f..O. .w..3...Y>.e.P".3.|\Z.....W...+O.1....Y.E...g..$.PT.$.7J{..?;...6.s...n.>O.].HLa..4U2.......F.w.F.....5....!...B......cc{..4.....1{1M.D..*h.Y...QSH.....6.....&.?p..u..X..39(1..Z..v.9~.ES..s....-T0a....{....i..4i...3...W.......#\.....-p....W*V...].!..!..x?N,...t&..n.....o.%..M&..K......t.#.j...g...r.SyV.....d..r.\B.e.._.h#9............=.>2...oUN.[..p...a.}...........eN..7".l...))z_...'..dj.y.W...2{.F.vN.....N...Qe6.p..uz......R.9.....A%.K...<.....w`..K...^Q.p+o..gy..X'`/m...Geq)....7..H....{.i....=yF.~..G...m.a.@.qc.#/..P.;{.d...b..qH.SC..^..b/9.......p*F..'G.`.k.8.H..W.2..m.m.9........W...}{.>U..+..rp../..../..Rc.<a....B..C>..a.y.!c`.bL.....KK...iQ...C..4~'.t.OMZS......U...u=W..=..RL..Ag.R...#;....!.2.,.J.I0...X2%....`g^.)...C.c...Pty.1=..P..........3b

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingsglobals.txt.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):44748
                                                                                                                                                              Entropy (8bit):7.995875281555227
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:F1BXZxXKrqb4OR+udt9p2yNz7YplkMsWh6yDYm3rJLDEr6b2/Fu6H1/O3rxspE/:F1BXyrqzR+uLLBYplmWh6yDB3rJLDErO
                                                                                                                                                              MD5:96867FD1418E1F7BF0A731FF09B06BCE
                                                                                                                                                              SHA1:A506D91D9BCE49495E392EDF6BF628D90B57305B
                                                                                                                                                              SHA-256:94F7E4599E13BB9ECD9501894D0940C8F996C382E75D49F21415D52EE562016B
                                                                                                                                                              SHA-512:BE1558158C60B631C2206F682C54C9EEFEB6E898D53148A286B8B3B31096908E77CA9DCFCEEF57260850BC8D70F964E61DD2E3A87C89B532F6F067EB6C7C44D7
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:....>9... ..|:.......Nt...idHr.Z.Z~..........=..?....XQ_.....k..$.[t.ww\.$..j...d.Ja.(.mE.5.^a...........w.|..R......Jw.[.9.JG.a....8.J....g...{W..D........J.Dc...y.-S.b`.fFyHa""[........e..A#*.m..`.%>.rf.>.>.R.6..D....~..h........n*.J..5......&.]....7..!.;.0Hr_...e.U.......O..%b....H"....V...VG....G"c.A.%.@G.8...r..X........yh...U6....../_S.N..y...T.......... ...y......8...$...'.....n?......;..H.:.cIS....K..&.[..O5..[.....b.'.2..=.+..l...{..l..p..0....`..?.TN.7...ZP....q.O..%YXA. 2..D&..2wy...^."....}.`....Nf...:...p.....9x!.}.Q.u..X...e.p.p:.9.p.[E.....y...|N.g.D...5.o..=#4....r@......nA3m...X.7.C...+X...-<.....z.z.>y5.p.Jk2H.U...e...a.8.c..jM..,...o.....Y...1..Qn.#..:ZL..|..BP.GP.;....R.)O.hO2.8...3..?.h.[...K{....ut..$...%......}..D.......[..lea.<..v..q...@c.S3..K..0Ch.W..P.Ie/{..........Q.W...K.Be.V.`...{;.z.l#F.%... .........6wEs......xO...@.dlu.."p.....C...U.kc..g.:.l.".U4........e...,E2..Ewj..C....&.....s.6..P.r....b......v.k

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingssynonyms.txt.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):103964
                                                                                                                                                              Entropy (8bit):7.99802208776686
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:1536:mEcKv6ASP6mFUpCfi2t+lf4Vjc6Vy5Sb51EweyrwsfrA97IkDWWq8URzTNJx:mEci6AMwK9VUSNOz7zWVLfNJx
                                                                                                                                                              MD5:7521CF9167904FDAF328CF841F4DB0EF
                                                                                                                                                              SHA1:9780782DF4CD07E326F0B52E1CCC6C3A6BCBDD29
                                                                                                                                                              SHA-256:99BD1622C8A7812749BDD32281C28899FE216F9506D36638C046FE49980A86DD
                                                                                                                                                              SHA-512:315853727581660F7883CD2A9259C20FCD32BC0E1472307299345F356CD088B3695FA749179EE2391EB0F7AC0697DD30940187D76A7C480CB7F419AD760A860B
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:,.(.n..2...X.2.........1..u..P.e.Ru.a....yZ.(....X.+.A6.i&....zQ.j$......V.s"EP.lX.a.]Hh..S......5....5|..T...5B/.......v.....?mx.TPc....|.!e.....9.n........).]..t..3.....N.....2_s..~..{.../.f...G.....;...u#.y..).Cv"...b.I...S...X...)eD.s.O.."._8.. .,........i.5o.*.8.?JV.$..?.Ay/.......1y...>.......9>. ..43).l..,xx{.f7.:...:..!...6..sX.....G...9....>..!6,.1Zwt.....Om.&H..q..F.E.`oVP....b..r.M..>%R....a~A9.3..f..xh$.vs.........[.e..N...<.....zk...;.X.x...g..W..h.1-...~..X...n......Obt:...>.......Z......B..E8..P.. ...o.7.....P.D..G......n..J..0.1}Y.d.2.H.Vv...W....X'...\..Z.....}:..o............S... \H.9...!..0...@*..].B...q.......k....*..).H.W.x.Q.,.w.0KY%7`....8.e.'..8N.t.FW.z.iH...sg..W.o.Y$..... ..$.......N.-...A.OOr%.......Gt....=.A.T.&..xx.J;..F.Pd..*..<...A...[....&.J..:.(U.W......Q..........n.p................f..Bt..C..hr.6.(9.....3D....;....Il........$."q^R.Me..J9V..G....NIn@.E.2.....G.DdA=...z.i?E9.J".jQ$............M.e.....

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\0.0.filtertrie.intermediate.txt.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):217776
                                                                                                                                                              Entropy (8bit):7.999169260478474
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:6144:KVh7AZtGaC2N1HQLQi7Bz42sNh+v5RqjcOQ/VYse:3Z0aC2NBQzaP+v5RqLse
                                                                                                                                                              MD5:02F74F12BCE7C263F82E63C0CCEC019C
                                                                                                                                                              SHA1:0528906CD6D1D20121D3DEDF8938586E5FD365F9
                                                                                                                                                              SHA-256:E3A102CB2D4BC670BE1C8FBFF06DB8881575E3FB4D351B06389E88F777912345
                                                                                                                                                              SHA-512:293B0706368597CC626F1B6CC5F9A2200E24A3989BA41795A9A232D63188F5F9398463C60506A26B1900AC1B9448F01383037D90D94348268B48E0DFDDDD2EA6
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.P....U.Kd...m.Q^..n...=.9?.U....2r4RL.3.M.q"...Q++..*]..5&..Op..k..<.."...G...x.>..2b....u...e......FM&.....z.&.d...(.9.|.S..l$.<..~.....P.r..E..v.....T.hu_V...ht...y....9TC.[...........s..wa@.k.h.~2o.V...g..!(.u..F{g....56...aq.qw.#.C....|V...w..Q...K....q...j.e.G.m......dE....C.|-8b M..b..2...p!..dD..:..=..*...F@...># ...3..Lv...... .|..2.i..4[bG...x...2..A-E.IK...g.~.........j2.....St_&\..`..Yo..#...8KZy..K.5.@...r.mon[R....v]..d....k.]@...?E`B.IO..>'M.>..P.g.se....Yt+.h..c....H.R./.w....e.w.L....1...d.'.fG.2Q.8.p..).....<'..f.....D.p.eTo.%.g..........lf....I...h...{XZ....w..\gt...~F+.*a......"Z.+....2)k.......-..z(....M.[.."k..#.e.......Q.5.N.+..c&=....}......kt!..")@...Y...VX.R....nA......G\..6\...^..Q....x;....zo.tJ..`,..1.O.....^.s...M<.p.@..9..u.}pw;.:..."|.P.e.+.....qb...v()..(..%...\M.g...J..........>7.".;..$.. .6..o...]..DU.'.#...fzn2;.z....../...&..Ib..M?|W...-!D7..W[.........p."q..n.m......7......ZK....-.N.$....)..~......>..

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\0.1.filtertrie.intermediate.txt.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):264
                                                                                                                                                              Entropy (8bit):7.180461543469758
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:6+oLG72rLnw1BCpHr7nrzKcgsScMMUnK9Y240pD:6+xeLnwzCp/zc3O
                                                                                                                                                              MD5:E539F0F7722FDC074527E4959DBDCCB3
                                                                                                                                                              SHA1:2B67DCC7B3A3C20D3B2599C39F04D0F13417019C
                                                                                                                                                              SHA-256:8493EB9D9B52C8DAD58A349FEEAA3D5487C4F5F27C8E6E18FFA8E7F0C796F089
                                                                                                                                                              SHA-512:4A06B016F684556DFA52F2EAEBBC06A009E5A26881DCF931BAE8555EA8E54F644DA205BE7C2E1A43FE949066F0B7CE0844894310020996C0D8B6C99B140FD7CE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:T'+<(z9..u../l..g...9...;...8...-.......zzt.I.wo....5-Q..,...N..z....N.C.......>.`c...YL.t!....$........k...l.....b...2..xi.}..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\0.2.filtertrie.intermediate.txt.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):264
                                                                                                                                                              Entropy (8bit):7.046907070113012
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:USGoLG72rLndWnhDf5PxzKcgsScMMUnK9Y240pD:USGxeLndQt1c3O
                                                                                                                                                              MD5:CEF4EB9FE9FAF972EC413C7ABAB9D184
                                                                                                                                                              SHA1:864FD364A06DA41B0EE325484E92696FC97410F5
                                                                                                                                                              SHA-256:EAD60C9DC0E83D31CCF64ABBD6A1CD9A0829C43B0CE583BE8823E28F5B2C40F2
                                                                                                                                                              SHA-512:70AAFC4CBAE656C777FA94B114C68ED336DDE43A8F80829748259AED9AD2A144B33C78A4FF3C3122EE749E2F3168740A52BCF810136BDCE9D9BB9F648AAEC876
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:...z9..v../l..g...9...;...8...-.......zzt.I.wo....5-Q..,.....r....*.e|./.fv....H....-].l.)k...mhr...1.....F=..)..}t.eXg}..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\Settings.ft.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):239442
                                                                                                                                                              Entropy (8bit):7.999139416868747
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:6144:mQCp1597XpF7orNW+kxiY/X7A3gkeyBSLO1Lqq6:QNjj0ro+kxi3erLO1+R
                                                                                                                                                              MD5:1C9653117C17122132D66EE68A8E79E5
                                                                                                                                                              SHA1:9EBD1636E8A612C95F9CBFAC4FB2EAB1A0B179A1
                                                                                                                                                              SHA-256:33F9453EEBEE8067F8C4F01E8349A5587EF3589774C7184BE62565145BCDCF53
                                                                                                                                                              SHA-512:AE6F032CC85097DDD34499DC7EE1C55391EE0ED522508B1563952F58909E7BD776D737FFD72991F0B959E6295A563C9B238388954662E03E08B5B7CC5C077C54
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..hM..RZ.e...E..q...-R...3..m.Yu....M..].j.#..}.y?,....tz..a..0....q.m)....Wr_7.t....U....c9.DN*9.L."5.r>b..r.T.+...L..{..%......$|<.......z".b+f..lc...8...b$r.Z.lZ..vX...............y.&..w.Jd.,^....3.Mc..C..G..~.5T.....7#.&....(..@.t).l..s{<..!........C...._,}._:.........[..L)}5.a.u.u.^.r. .%..L.H.W/a..6....q|:..D'2..^...-<x...". {....d...m...........k.4....&.x.C._.O/.../.gM.@sI#..u..S}.#.....z...QU....t .(.....#^W...fx.3x.R^C.>2.1l~Ac...uc...e.........m[.U.lp^D..'={....h...}P.....Uw.o.8e..I...5.....[4..N..z..p....R....R/..%T<..$...a;.)....,]o...7;@g.Oj.TB..).:..f..2..(.......;7p....fB...Ca..."...$..x...."....C.]..O..t...m.zF..`.U......i&o`...Z..?m(.c4...../.h.?.V....1q.82'..!.......j/.......xa..Qk..9@k..b.Z./.Z`....J..........-..G..0.H0..L...u.....CcU...P.(.Pi.."..z..e..l.h;../......P{2.Q.=c..p1....F...L.R.H..v.3'.^j.l..sK..l..d.:...+39.eu...Vv...-......Y.Pa...O.l...3....w ..W_M..d..x.......[.-s4...h.g&u....lU..iS9.Q....Z.......Q.....j.Dh.....7

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\Settings.index.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1482093
                                                                                                                                                              Entropy (8bit):6.647338613269466
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24576:Sr9PBTDTHtvrWzd8COuZ/kr2bEEYz1jBa/mqkNRM3lVKSuo:2HTNvrWzd8hR3z1rM3lVKSuo
                                                                                                                                                              MD5:729C954B1EFC7F7DC5845E9197967201
                                                                                                                                                              SHA1:47FA01AA3FE593AC6EBCB70FE24182E45CB6D5CC
                                                                                                                                                              SHA-256:7A5D4179B15268FC05777ABC8042E4472AFFABD45C6965BC642DEC72D66E729B
                                                                                                                                                              SHA-512:720AF9C5658B8368F6DE6DB61D6267F387D20068345516B3ACE11403561A3FB88B4351E38D3276AC56000726003E0D780DB5FDD697E5D6F0E06ECF81E3AEA7C7
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:;n.*.*.<.).{.6..+.5W.....h<.DTa|....|...Q&..._I..Q...B.+..K.p.,.`....0..F.._`^)_.5..V..)..X?o.)...I7.....<D..?...-......[w....](...\(....!HB.8..S.....L?..9....+.|..E..q.?...%..l.....+...i`..a.SQ.....).Y.t..1$...8.....;.5..t..."N.....9.3@.....1..&......t..r.nG.E..r...->L.I%.)Q...[...zf............&...'...r_./.e..-..#.....~.h.K...e{^..d.....l5.R.?#...f~_.b..dD.\...^.......T.E..K>../.m..(1..$.4 .).h..AM.f.Rp/.W.....].=VX.^l.<.nvCU......1.=..........2?a".A....t.Y...b'Y..zsi..H.b....(.....9......F.Yg.I...t....Q..AY...&.!I..0.6k.t.).>].R..f..^....V...e..5<1...ly.2{n...m.....'.@..[.-&..:.y...].K...6.Ku..X.(._.S..T.3E...?...X'LH.B.e.X..<...3W..> 6..fk....G..0D)._.8...X....B...m7!.!@.*B.w._u.[.{.._S.JS...q..........g0.*...Q8,..2.p5...!9.......^.5.....c...G.%dP..z..`jmu.K8...A4....@..C.M*[.9....G.A|,.Q........r...*j5?._].n.Ne.n!......_).....{. ;.d....Ug............k...6....../-.g..c.R..Q.).....d..oN........g.^r{...f....E.....+B_...4....AK..

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\Settings.ft.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):239442
                                                                                                                                                              Entropy (8bit):7.999241672149936
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:6144:QdyPoG0fDzHtjPdkw7zURW8S5Gz3bOSmMIFWUF2B4Cy:meo9DxjPZvUwpWC3MIFnoaP
                                                                                                                                                              MD5:A7E878336E1C6B47AB6971D98AAFCEE8
                                                                                                                                                              SHA1:0BC01A36E289F77E0F794D2020C9957FF14F5EE8
                                                                                                                                                              SHA-256:FCF2893EBD83A01A84AFEA3BB9A2DA34F8F9572EF016F3D35A7A221D4A094E46
                                                                                                                                                              SHA-512:3D861460353B8999292AA4738885524C36E8C82CCBA4BE08708E0335D4610F240489BA3AD0548EEE03CEB443507D79688A9E146834FC70C3CECFF3E587B53BC1
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..k-(.*....%N.v#....3GO=.....zP......L3.)t.Jp..<H2+.^.}.{..FQ.$.....y.r..XKqJ..##..6E...:.9....q%P#H..X.....lS.V.)...S*/DE.*Oh..F....s..."..6L.w.l..,...%..no%.2.xd.9.T:.{.W.....V.q~jl>o.1..%....w..N/~.h...{CHL.............P.F..`.......@O.L.7(.z.*...2X.Bn%)f..@.....;...s..A.I.ob.w\8......S..di....._k..s5....:&...-.N...v......H;WD.........{*I48.K..[..U..,}J.1'...T...,..43fYl.%.S^....OQ....Y........?.A@1..X..........4.. .>..KP.ZhHU.....)B....`0.O.`S_../........q..[...+.tGo:]./l..>..l...p.g..'k......."..Vp.?..\.t..3...N...p.vD.~0~..9W../>'...o.1O>...V.R.t..d..j#+..#.39..!..V.............).3...c...l........He.Q._5.h..x...BAQ.U.9.y..W...t4Mv"k8W.u.*Ff...-.J...80].....?....G.&v..L;..Y...{.I9....3.$.9.a..Y.D..M....G...G..g,s%.r.8..E.d.....6..Z..Hi.'.[..D.r.M:O_...5.e....[r.A~:k"..:..)...O...>.)-.'.Y.....{.s.}...B;....#.QJ...!e..O.?...K.....+...{.Z.l_...L.)>..kN3.#...Z.,M...-.....u...4.%Wl...A...a... ..[{...L...9'"H.....%..5.s..@.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\Settings.index.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1482093
                                                                                                                                                              Entropy (8bit):6.646371645940219
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24576:4iPBikB4Zv59Lyyxw0c8COuZ/kr2bEEYz1jBa/mqkNRM3lVKSuX:HQkEv59Lyyxa8hR3z1rM3lVKSuX
                                                                                                                                                              MD5:BF62ECB9D135063087208507B84369C7
                                                                                                                                                              SHA1:FA0D3CADB3851223338FA92C0E8BCE8D86C26BC4
                                                                                                                                                              SHA-256:A49F297B0827903F3E367936E234D79CFEEDCE4550B36E56A9205D4FD3951C02
                                                                                                                                                              SHA-512:54D73AAB2EB5A1309B2F8019801C230BCE64420CC718AC81BD5044C8776C7CE0692502E5751E1BB18C9B2E76AEE8223C5230078F1BD46688F5149BFE7E810E3B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:6k...w!(T..w.Q3jI.6r1.i.nQU.....A8.c..db_<..3V.z#.0.*<.?.......e!.8B..{;..Q..9/H.g]Q.8....#.w..6Z.....S....z....Cg....+YR..[.Y)n.....L.p......../1.9a.7....If.[,^..-./...p.....Z.<...-]...;...6........U...w..N..~..l.....eG.h.8.%.5.u..=...U.z.$.u.(b.1G..V........F+...h).......!8...."../...t.wS.c*.1XI.*.....,....'.*f..8..r;r.o@l.F..Z.....$..d...k.E.)....&B...a....F....9...'....V......&.v/l.Y@GyD.-|...O.>+.l.._....'.*E....O.e.Q........Z../>L(,.p.......!.S.3...$.D.......o........[.+......T.[.j.L.....o...&H..iX}.eb!..k<.....M1...9..;.....".R.. ...z...........ucH...$:......_.jo.s.S...B..O..Fp.=Zv...h...d'..?...]...SM.Q....m..C....rN..PR1...<A...n.V..R..>.*xzP+...+.....!....(N..it...G..&'.?.3.>.p-...(...@.q.......z../.....^*.-.|Z.k....r..#...ih5...........x.8.-$.=.. ]X..WC:....-wiHL..Z..kR....I.hj0u.A........Yj}.O|..G............Jh.....!.....J...x....Du..Y6.p^{....m3#...W...I...n&7."R.~.I/[.c@...AD.l.k..xTGK......d....f.....:.7.T7.bf...

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\RoamingState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Settings\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Settings\settings.dat.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8431
                                                                                                                                                              Entropy (8bit):7.982304395740726
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:laXKiMItkJrBjTprvct2V7AzFB1EqPM0tBu/SVgfXMe+:oarr91co8zFB5PM0tBU4je+
                                                                                                                                                              MD5:D08408BF7981C998D6DFAA55A3B56CDA
                                                                                                                                                              SHA1:DA5CA3B81623A4D2FF5D65DB2246576C94AF5309
                                                                                                                                                              SHA-256:4C4D280826BD287A037C32617B45F467F319C2A72C43DA765697395C0008FFF7
                                                                                                                                                              SHA-512:E6C8476052154E8085CCD2FC012A46B510BD10A6B25B648054D1B67E93802C0762294A630EBAE01878B96471B20AD27F1B94DC7D4995256481D9DAB0668B356E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.S...Z.U.#.....,..y.)Lf^.....G.W`CL.jV...&.kJ+t....j...p..V..X.]..^J.....`1.....~.Y..W...$.m.R.g.'.mR,.......... v.t..l.^......+&G.....<.!...(.....c..q..7..bm.x......~.....`j+y.`.v...,r.G%=.I.. .J.+_C..kl..ZO..z"].f?.h.>X^W.7..x...k...N.6....x...^..a.c.....).s.?V...(.......&;..[a'6SCG.....m5..%[..lVn..6.i.Dig..E...CU.^J...e4...w...,gb,c....H9....!.|..,...2...mR.gfK.R.....fM...T ..^.._.y.mz.oQ......iU...(..9G.7}..]V..d..;..A..W.T..Y).!.............gq..^.)b..y0AN....j.1.....V0g......A.d......R{.64....(3D......b..f.77.M m...m.E.s....h..ce........`>.*...P..6(6:2..S......~..D.gE..0.1#....y..Q......U.Y.R..g^.....<y...../...s.'.*..ow.i_..S......e.&.M.?.U.s....u:..p.`.e....o%.@..k.14.q.,u.t.]RQ=.k.l....2.2..f....pc....~....,...!!..l.n'P....{.Z..p.s].'.....D.5..16.T.....j.......k.x....d.)...b`.A..J....b9D>.h0*.J.......Lv.#.Z.f.........n....N....]B......j!V..H.l...../..3T$ID..#.C..!.]:.../..o..wm.46.*... 3.'..4../.=.,....c.J...v.E%......

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\SystemAppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\TempState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\DiagOutputDir\LogFile_October_3_2023__13_9_20.txt.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):548
                                                                                                                                                              Entropy (8bit):7.661648395303537
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:REbGwiFDRVgFXanvXam5kbnhjT4yx2TVJ3O:ReiN3XQbhjdIxJ+
                                                                                                                                                              MD5:967A7FFF32A69CAE0142DDA51368A691
                                                                                                                                                              SHA1:79035A72067EDEB105821AD6DC48278577B95446
                                                                                                                                                              SHA-256:758BFC258E4F136A75DEB72EE93E3B653BBDE059B45F37D6ED46882C1F269AAB
                                                                                                                                                              SHA-512:1E96ACCB15C5B96A664C43CA24EF4D0C159AF967FEF0662689621C1DFE4BE89B7BE8634C81E38DA81A2E3B68B5DF686A1A9BC97A4AE05D0015125F2A1B655F65
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:]....O......6aZ.............0..Z.4;8...S..w...x..R:.m.u2(z..}.PN......8...2j.....F.BHfWh.3......qrv...~.....H.UO.....W..df=,..............9,.$E........b.;...+}....p..r..9..QgNx.$2e-.O....>:G."...J.`.....=..."k.g....~_'......*abbyYo..I.Z...V..\.N.S4..9......h..Z..9..#........`.....4........N.bx.....4b..I.4....5.Q../...$>..nwM.g(.N6j........@.#..f..S.{..HVr..oL.....2.9...0..Y...;.qY#.j1.K...X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\DiagOutputDir\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\Settings\settings.dat.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8431
                                                                                                                                                              Entropy (8bit):7.978567627588705
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:JEdVfFucpQjcxcohVpFKju8QrpjFG7FoDhxVhf7ilwLMdtBI6D+:6dV5pQ4c+VrKjPQrpj+o9hjdLItC6D+
                                                                                                                                                              MD5:A29D8DCD3914EF02BDCF4E6A05C26B35
                                                                                                                                                              SHA1:E37FF0DBD9B2E1ECB5E097C43910A3C551781A8A
                                                                                                                                                              SHA-256:FA91659FEB463C2B7150F65810B61F6EC3B18E03F4A337944BE690573BF30EE3
                                                                                                                                                              SHA-512:01F1A6FB16264AC64586A48502B52CA06A75175E3EAADB34EE3806E9B28421B320405F6C3A69F823369096089620F86626B47951735B5498794039506C11C767
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:v..F/}.).c..|B...-J...E.T.H.V.u.e........$.y(V...".Z4........uq.Ez..8U../j...V...:Yrr.r..+0.*.q..o"....D...n?:.c){.O.l.^U9;...J.(i...G{i.u=.......~3+.I....'f..U-fG.u..KD..o...=.....$n.......J(.....h..3..*...go.3....s.h..`.v^......f..Z..7....OO.Ly..... k....4(.c.t.t..'....@....aV....A.}o............_v.... v.3T............L.e.;.?.h..$..r.g,..{...*f...#,p......xf.|...z.0H)...1...{I]...<..UY.)..?O~..!7F"..e~..'......RW\zbKA.hcg.W....g3l`N\..{.nvIBU.......E$.b;K..#...[MK..........rn..`D.....3.%2b..%..R.e..REc.T......J;......{.M.n.....a..Q......U.d...{ux..3...G(....p.LW.G.*]."x.*..GM..V....II...6........l6..F....PW1ps.u..,...E.;/T....-....D.1......v........m....A.e6I_....l..p...6..&..a._....%.....j.I...."...O....q.DD4......\.i.3...!.o.q..;%.i..S04H$....I..5-.hz.w.4#6..B...K.h...Y..s#&.......Y.;.\.....Rta..D?....W.*..d}...U...B.j)<.n..LO.L~.....P.i...MG...z.......i......#......P....I.0)...h.. !.=.,..#'..j......6.Q.P.-^...}r.. ...1.&....P

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\Settings\settings.dat.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8431
                                                                                                                                                              Entropy (8bit):7.978479678976242
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:jdg/XVZiBk7GaXGKpESc3OLvZxhIsm34+0u+:uvVZ17GaWKEy4smB0u+
                                                                                                                                                              MD5:071BF38F77FA35B8AF47E3E0E0793A37
                                                                                                                                                              SHA1:3F420F1DA16C0C302A607D3C60C806FF81077FB9
                                                                                                                                                              SHA-256:1980787CA9D93D35AE9327E1856EB9101E1BB250D447D41A69A0A5E84B1D0E52
                                                                                                                                                              SHA-512:0B5F7408829FC9BA32C1A7E94ED13D1DD894388E61990010D5F76829C5C476F436FEBDDDDFC080FE270D7DD130D91A729FBDFFA5E483665CE085EDBB012FB7D3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.rt.Tn>..j...=rM.....d..~z..^%"..U..,D..F...>.x.c.L...x\M../.(|.a"&....=.G..|d4/.Uz.=Q....jPI...'Q.xP.o.j.N..u....}&n..b.C%{..:u../..)...h..2....15....g.D!A.\.Iq....).......).,.|z..<T..._v..G$..u#2K.d.S{}..6...i..4....^w.i...D@nw.../.D>+...P..@...AAa...k%..D....G].^t..ff1;.*O0v@..N@=}..`....J.t.L..p..z.^...e.......Cr`Y..A.rm#...re....{.m....>.N.*......1......I...R?#.....J..9..^...).q.....#...k..s.O..K......M...`I.l....P..,.......-.2Y.....6Zi..."c..C...C.....l1....~[..]O.k..>.t:6-k.bV..........D...L....E........!.....y....j..}...i.Gn...h...4'r..\..h....?.d.M.Y.2.XG.we.Q....I..U..c.....UOE.+C.}.q..-1.ww.....7xe'..;@a.O1!..."....x.+6... .n.K}....{V.....zd...m..U..yk........(..l..d.E..kVU2f0W=.@.T..D.C..../..m7@D..A.7..1)......%.J.$%)..b...40........._.....x....1..]E..2~*.K.*...1...._...mK.... X..H|....|fT*..~.mj....0}#.<K ...".z.@.......>.....!....Y.?..rh%w.kT..F.._.jB.....B..k...0.......F...'"..n......m.VQ.%..."...-.....l.... .../.'.

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\Settings\settings.dat.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8431
                                                                                                                                                              Entropy (8bit):7.9800338076371125
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:eU1QSYsx2HvXb0UvYzHTYzMa93TcrJr0ZoxI62X8m+:UsoHPblvYzzLEUJrZRQ8m+
                                                                                                                                                              MD5:DF3F5381E0EF961FF80611B6A85EE1E9
                                                                                                                                                              SHA1:40ADF8327F42288CC4843210109944A53F165838
                                                                                                                                                              SHA-256:D27721800DF669B131616BFD4297F05C2441E6C8E4916657FEFA1F37A077FAFE
                                                                                                                                                              SHA-512:E5A1D4932AA394CD0E7A2C1D90913128E163A883CB0C43FC753AEF62EAE43947140527C965B675AD3FD5168C15AA34225FE3F9CB68B074A7ADDD988CF7B4E6B3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:h.&v..W....F..5..HF..k..;..|.....{.Aj..2.."hf..].......$c...g-B.<xr.d...h.C$..C....*.-.l...PV.:..Y..'.Or.ex-h..I....Bl.=....h.U4...u.eC.F.....k.....b......Z..u.o7......."...w..>.H.T.$.n.. .%..o.d|.R..t.c>7:.....8....."0.K9.>..BG.....et.+..",...2..'.8..]........J._...G..D..ZBt....&!H%h].K.%/.m../.bw..i...A.=Z.eC...j.9.}.woB....w.I76....t4.n...Y.{b...}.....x.pRJ@E.`....Z.6...P.`"..(..?...I.sva....I=...(s......).....p+.....D^.5.s...~.\.A..[.%.."U.p}..../.E_V....t(.N...x.L..L..~...2.d._C[.nQ.)/}.....r...`ZR.[J......i.n........u.-.\.......2: P.c>.....].g.z..q.z3]...N..".......A........".nBXH..ll.!.f[+]L.I....rw.J.{MZY1. J.X.>[.k.s..w..@......LJ...f.?........l...Q...OU.7 o$.M.f.dL.GE.0.!.iPE.......>..DK....... !.....}..Sr.pyf.k.F.e..Y$p+....'......Hh....S..;...1.]....J$..FR...:.....0.O.8.D....}5.b~]......".:....=..v.Qg.......u.+.t..'..hrLi>.B.JyPN.D..?G..p.M.....D.E....X....G..vn.?u.kf"b.J.C.P.x:FS....$.......97....#....%.....?P..b..Wt.:...C..2.c..]./

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\settings.dat.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8431
                                                                                                                                                              Entropy (8bit):7.979411222205683
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:iMdGvuKyW94mg1zMgXf9Yze02+L6QbW1xZW64wejdAyx89thU7+:hU94TXkBTu1fWUibqU7+
                                                                                                                                                              MD5:02696E34BF385363566604A599104803
                                                                                                                                                              SHA1:8C56C09682F540215CFB75386AE960F255927DFE
                                                                                                                                                              SHA-256:214680D49B20EA8CF1BC5D9B329B7520EF848DD19E025742AEF8E7765A01A58A
                                                                                                                                                              SHA-512:ACA919AD4B7B6938A037428D72FD41C62945C43651E068E232D273DC7B60F9D5D1C8159B13E4CDA7361D5E3F4F9F673DDAD96DA10D6FA5867B6061856CB09810
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....O[........F......1J.:.R......mK..ze.w?r..q......S.Y{.....%....[^y..AT.]..#<....._.$b..c..h...a;j0C.b.G...\.F...e.XH8...".B......V"[....m..W..z...B..J.H.n/>..T.....;+-.<h.he..9...9I.....Y.....<(.O&Z.....>s............>EtL...]ic[.L..h.n...PI.xY.hi/..b[..F^.F.3....@N..Du..?.."...vM.U.$..p...a.:......:"......,.dz..p...Xh.P=_........o..1o.W.|.2Mv..]..R.3.^..ef...... ....4...Liq..N..>:.N..0[F.k... ....-..6.mN..P...8..Zm...z..Q.u...d..W....).S..c&@I..PW..R^.. ...m....-..y..GV.....N..?-M"O.....c.J/...NCr..`.*...m...k.].^M....e.N...9+.b...E4z....2..5j..)3mp......Q.'|.%5.M5+....6.u..z..#...0.4..Z....A...c....+;_....2.C%.[..D9...U..i(.O;...[.r.@T..1....%R*..H8w.r.z.c?...V..e..SLR....tG2mas..I./..07..w.0m.9x8.V..L..V.".JAl"...(.o4...T.T,.s.....}.i...P.#~.H...b7..-WHL..Y..d..(.......].D.f...d......P.'AH.....4........By..nB~...4..0......,.......\. {:..a.@.A.F8.....G..G.L....uo*I.4`...T9yh...>.......5...n..."A5n...@..Tv....CG+.5.k..yE6b"8.J..8v....

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\Settings\settings.dat.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8431
                                                                                                                                                              Entropy (8bit):7.978481779807948
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:Sw4HUNlzncT6bU+hnUUUifs1cOq+7PjKzCdccnRb/r7xej+:74HgxcTtan/saV+7bKedccnRn7xej+
                                                                                                                                                              MD5:DF3243B3AEE0BB85D4359D329CEFCB71
                                                                                                                                                              SHA1:1EEDFB6B67E743A8019744011474571BA3B712CA
                                                                                                                                                              SHA-256:AA02D4A52FD9C008A69E04AC9D26667CF3C36BEEAAAE84861535895D2EB8974E
                                                                                                                                                              SHA-512:AFF77A11B13B8D734693BC9F220827F55967FEE6CB2967B9E20A65E8A705A877AAF276373B31AD78B45E1B46E98601F7748068FBDA161A7775030E4BE4BD9E9C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:o<.......<.S.u.M...|.|{4W..!.I.GN...}....gym..s...Yo+k....K...h..{.e.'S..kT.H.i..j..5.,.Fj.C.e..d.3.....:c...'.....@.)...Z..c.J.B......7....e2u.......%[.....R*... .[Y.i.]."..u8...........jB>.J..."u.d..u.#4%...I..3a.....#`a.v2..."F+.H.......(...}.....u.....W=...l:.....f.R.%.r$w~...3z.A.....(.P.3..Z-..yU.h......k;.....Q........f..%....0.j.z...Vm.{` .H...p5...,o.q..#".k......BX.D...[...'|....&...A6...."++...].i....oCnJ.2.E.u,.L..Z.M..re..Y.t..Sr..S.e.W{.. .+......Q[../...>fE...&..........z...Rg.....g.,..:.oJ.p.1.e'.........F8.&..F.|(....:=..[.f...ZV....}.3>.5Q.l...4.G9.m!/..Q.L..2.~../2.G'.@se..p..3.../`......g..t.#_.i..JPS.A....T...j._NR.....D.~....^...f.....~Tq....AKwV. ..[.#...Hx..k9?.R{...G.....?..e....<...,:.....[.p...'.o....V....... ....M.n.BD.8.....P=.....h:..g?yesn|<@.|...3.`.I7l.r.0...+.&)...E.V..b.(i...i..0.2...tg....3..R.......m.ym...j....v&..!._...^?..>.#....!....................)...P.p....x.a.!...)zpP.(...i..zp6.z.].3..i\..B.;....N...

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\Settings\settings.dat.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8431
                                                                                                                                                              Entropy (8bit):7.974293044783181
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:9WP+79vPhRIs0aemv5NntSXltPFxf1NNF1Y9BjRKGW12WE+:vZvJR0aemBNnEThNBY9N8Z4WE+
                                                                                                                                                              MD5:B14E572E8315953BFF6DE74CDEBFEB23
                                                                                                                                                              SHA1:04E7A47398EA337416642BB552C534D6C873BC9A
                                                                                                                                                              SHA-256:03C979017EFC31A61FBCA4280F20B90C1608DA2E019D9EDE476C78CB65A76E81
                                                                                                                                                              SHA-512:67973CA7D56FDDA37222C0318DE53E43F7694B4ACCB1606ACCA14CDF58FA3A1025B332179A17DFD94FC75E09FDFE3E57C8F4D8F287F3C236E70672133C2EA773
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:...Hg}.N.v.s....-.6<.QP.PMl....>.$Ge.^.P1.y7$..I.r......i.u.R.....p.'g...x.4..F1l2...e..;.Tb..........A.q.'..l.B,V,Q...q......e...C...e..|T[ .^.<.. ..R......o...."E..<..v..x.k..N..:w.N.e.6L)......y.c...Zy..../......4~.A..r.~..:)t....pP....jI..Nwl.{e..X...x.5x..7U.o.....p.v...0..d....H....Thh.%.{.v.I.....o...y.g.XQ...I].;EaW.......y..ey.x..b..!gU.<....G..T.(]HH./Z..@.....E7.........o>'......f......hh.?..p.H.0....o...u,.e....~D)x[........H..o.P}..;.~/.9...*.Z..R..w.(.5m..4....3..z...j=...*.k....W....@.i.nl.4.U...t.........(7xZ.N.}N....r...&.h4.B.H@.a.#."....8.?w....P.........8.R.Tu.b,).XY.....`...P....uf...wO..M'IO..[}.....Udq)!......4\..aC.cF.1"...X.......#h|.WF1.T...M...Yw(..l..'h...C..x8....'.Abw.P....X..H.4Sq..b.'`.n.cy.5..W.....l..)o..-..iV.....5.nU:.h.9i.v....ST..x..JO..V-rq..$U.N~..~...a......zH.L=.......a.....^...i..c%......R).!.-..6..K~S...."!....Z+.6^..}G.34R........gB+.}...&.R..e..B,..S.(-=#q:y..%..iT.~.Gv{./.../.....}Y.w......L

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Temp\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalCache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\RoamingState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SystemAppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\Temp\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalCache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\RoamingState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\Settings\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\Settings\settings.dat.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8431
                                                                                                                                                              Entropy (8bit):7.983172989876346
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:hpW+D75iH+6elmKMC/Qp/D74J197aCV+AsaLv3Iq8dX+:h9P5iHm7V/QO15a2sakq8dX+
                                                                                                                                                              MD5:0637B79EAB12E46BCFB3DE07F4E3792C
                                                                                                                                                              SHA1:1FF0E890B1E05E0F5E8994CDB085EB5FCCBD5498
                                                                                                                                                              SHA-256:44BEAF7163D6185291584A32E99EF23A2A819A794AB49D23FC58EFA45A66181C
                                                                                                                                                              SHA-512:D2E13D9B50462121F179A2FAC5F9160C501C907122BC6F2BB7E93B28EB1C822F697BB171FADF694FE674D1B661262A425DFEF47777C167DC9FE588342A74E340
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.|...M.....lOm.....H.].TB !...O..9A.~.r.84$].&...4T;.Sd.......U.D....<..hn.L..s]x.L(1.......j.V....-l+...v..1L....g.H.i.......\.=DuA.^......X.3.1.m..O\G.<Y.......D..'..J.B..M.-Xh..s.>..~..0.nt..Q.*..n#...v.~7..{<9..jG..U....J..p0k..t(.ec....g.../.K..Zf}m.x........h.Be...%OW.r9..?$gBWv].I.k.l...O.!....d..."w..,r.g.e....8x..W..Ku...>(=.m.....*.^....31..c.Q..~f.l..x.o..a.....N[+...%B..VQ..)<i`E...^.[..0O.z...N.....|.!+.R.}.|.#d.t..8r,..[.i.Om.S..Q......y)DMhlj.=|..i..h1.3..VQ.%]~.-..S......a.;..M.{C..V...&oU.....5.ba:...L.T.2.$...:......3Z..p..!+.z'G....x8..=..;a0|{....[..+.k.\..N....Rh...?...K.JI.#.f....X..x.q..'..M.Yw..c=.5..9.....a.L...Z..~....f..7."v.p../...H.R..}..<.9E..}ly...(&..@...g....O.l(;.'......`.k..7.<.A.6.c.NV...lc.......xK..P.../.*#....B@+g...N.,E..'J... E.g....l'...`.{...#...^...^].G...-...y...*.....j|B..I.R.x..8=o._]n.o..~PH.A.Y..0B|.z.;-4..[~>....B...l.9.'Rs.......1...[O.....w....)./*.Hc.^...+........5..{5...G...6.V..Z...

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\SystemAppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\TempState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AC\Temp\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\LocalCache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\LocalState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\RoamingState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\Settings\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\Settings\settings.dat.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8431
                                                                                                                                                              Entropy (8bit):7.982233461636982
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:B39PLSUm6R27DLlouW8ARcsGXTx9NdUKuVprf1/Ett+:B3AscsGl10fitt+
                                                                                                                                                              MD5:F30B799F5750B26118112AEE81367B03
                                                                                                                                                              SHA1:444BFBF1C503EA26717784284591BC26B84AB21B
                                                                                                                                                              SHA-256:EEB0080EAF50049985F1F6B77ADF9772BD33B62299CF4791F1AE50AA29B8E6B9
                                                                                                                                                              SHA-512:F07FC59BDE03F6A3DC5737E3A8DF5131AEF00CE5FD572CA5ACEAE80DDC59A83849751C1563637D27D7E2947E72FEE179364462F2B10FC28D9FD8CB7D2EEE215E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:p..7.4......I>.~4.OX..Vf.d...<9...P..C...P.su".i......}.....xx...r..P....:.....+.[D.j...rc.z.=,.........{M..x.+..& ../...S..,.%.M..#...'.k....\..lj^.....2..Qy..>B....D.a*=Iw..4g...z.._....*s..*......Z....1.<....D...xw"...._.}.*>....i...............Q{Lu.m...4...:.V..x>. s.Q...vY..p...X|.W"~G.2}.l..>.l.p.iV...<..EF.pXH...4....-....8z{.!.....?z.(W..m$.F...D.).a...i..;..k..psU.6.Nt.3y;N.0_mp..u.....(m...-'..[Ml..1....x....=UV.o.8-.9_z{#8.F......>$.sI.~...h.[.|K....>@"^Q..FN..~..s+.......,.9.z.A...>..Pby...c..>5..vz(.PH...E`..:2../.+.A&q.2...:i.....H..)xWsy......X..X.R..0.f.)XX0OO.........=+..M....15M.....=|..........v..m...*..aQ......,....e..$..?........*0.8......"\{kW....]...pY.u~.4...@....`l.{..DF...8..........8~U...U.Z]."3..B.a..2.....j".*.M.........]...f...kR.F..)9..T..o.U{...>!.....R..dc....L...,..F=.k.>b.....]..=0R.64..D-.P....$..x...d.2..5.[...b.8E.V.H.{.W\A..A.X..w....O.rs.h..$$.,CNN.#1....C%.8.J......v.9.+%}oy..Z...S&.X....../...

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\SystemAppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\TempState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AC\Temp\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\LocalCache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\LocalState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\RoamingState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\Settings\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\Settings\settings.dat.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8431
                                                                                                                                                              Entropy (8bit):7.976152879333522
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:vNAIN+/L9NjbKplcm1FUIRDQ7DO9QYkS+mHBs9vbr+:vaI8j9c3RjUIRDQWf+mHBQDr+
                                                                                                                                                              MD5:8D1BC9A59782FDBC4B6E9385AA232733
                                                                                                                                                              SHA1:F5DC45688010BB68E195619C9A657BC7BE1A2F09
                                                                                                                                                              SHA-256:2C34CA0973526707F7780A1F0570FD8F895D3FCAB4691453605772EB36C27083
                                                                                                                                                              SHA-512:0AFAFEBC869C15BD7CB854E27DCC44E433D4617F50258DD5AFC2DFF30FD56E25053979479D86979CBA7D38FB54AAC0FE6B6ED75F2ECC5B45A36DAB7DEFC5E2E6
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.uw.{]..:i9..O1...........a......1..[]:o.T.9k....`J..w|*."9j..e*..C...i.X..lS...@...nT..^.....z.1..@d.t`.!G.....2S3~@.THc@.....2..s.M.m...0n$j.h...*^.......`z....1.u.///.3..V.h...~V*..)K..?...U.DJ..2%......U.;....,o..F....Pv.....n.......5l...\...K......:X....Qz"..j>n...n.v^..HE;.?..]..^.P.cP<.\...B%A....p;.....0.^...g..o...f..$Z...a*.{..f@....)}x.....oNU.t.,...?..p..N......m.WU.`.7.yG.....V....|._!...#x..'..d..t..`$.k.SM...G.1F.^.-...C.H.l.d...W.h.2#C\..4a.u..[5.......@..u.<.?.E.4b.s:........B..a.r3._..#.!.7[..Y.*...D.ZL.w.p../..S.._K.h .:...T.2..(..u.........!.o.0.).&.$.9n.1.>.Y.lp.5..P..I1..;*..X..+.p(...$a%.g...a}...H..P.......#..;....=..3...l..#...B.w.}.w.W.;|..0S<D.I.5!o...E...OG..b{..]i.2s....,../A.oMQ).V....j.f....-.:.3I...K5.U).!.+.k..t..2.......u..~.O...:q.I '....X..u.J..VK...Y..|.wu.0...Z.H.f.~.L....,!@.....Y.a:."+...\..........-...lV...1...[..7....-.Y.....)@..-@...w.qs..s..W...mW..5.....l..o,<f..... .d1J...../.s.To.MN....2#

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\SystemAppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\TempState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\Temp\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\LocalCache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\LocalState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\RoamingState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\Settings\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\Settings\settings.dat.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8431
                                                                                                                                                              Entropy (8bit):7.976884256622233
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:09Azkg7lf3k0ejZynB/hoYcsxGgKiegKDYdMwYEvsKnxEV8KUdrj1+:xk2VGjOyYclgujY/tD2V83drj1+
                                                                                                                                                              MD5:89EF8472CE26610CB58D2C7EC2C78FF6
                                                                                                                                                              SHA1:B2523DDC2CA492D49880F2EA7084E80788314230
                                                                                                                                                              SHA-256:A6A532EF416B932B879AD784AEC89869BD4AD43508A55DB599C84D50EA8A18AF
                                                                                                                                                              SHA-512:B5EECFC41C260EB70895D3B98C26A7EDD70A64FE741FAECE595599C6E952D82DB921E5A4476F22A7667A877FBE3D3AD8A5CACB5AB50DD0332DD996BFC9CABC27
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....i>...Z...I..."J..6.LyU....6.#.l....M......L.=..KG..............3S;.jX..?.....u......k.$.....wbH./xAuO8.......<N.,..k.x%.U.W....I..\/....E...1&*...PI.^....?.E..,|.rf.5. ...w.5..g3BX.|.@.c9Sh.Z..Z.....yG....w.g~.6....g...O..4....z.f....D......&...h....---!.WY.z...._..F..m!...n......7.*..J..!.Th..m\O...8..=..(........W7.>-u...5.P.k~.. .G..$....;p.._D.4/..."..~..#`.W..'.:.Z...I..;....c...?....^.XR.....t..?#N!.<$.=..D.-.`m.z k.>.U..@._.....g....0.I..:z...^9".K3.V..97pY.maO.d...V.>..r/x..7V.....u.n].I.@+...#.u....\E^...!x.F.vRa`.=z.f........nT.f%O".v-...0......R.U.e.D6.M...|...2.....MP..GA[a...!.....p..0.Ia...*0Z..:.7....Qz.k.....v]o.q...g!.X..e..m.XM.L..{C|....Hr..I...".z.-o.2fm.2.2k~W.....GZ..x...}.0....((...x...|...U>..x.o...Xk.eOM...v...+..a..l]%`7.wO.....m1.+.X./&.EFL.N....3.......1+(.s.#.J.C...=mv....t.............i..I........y`.......:...{$...]C?f.o.MZ9Z...i9......U.@..X.NT~).4t.{.....D.7.v\..W.........F..&" _RML..>A...$..R...J..*i.+.X..

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\SystemAppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\TempState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalCache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\RoamingState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\Settings\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\Settings\settings.dat.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8431
                                                                                                                                                              Entropy (8bit):7.976571637870517
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:GZMLZCeVWlTqTAi5XoXH6vgHuRNHD95esTED6+:GZletMiAH6vgHM95/ED6+
                                                                                                                                                              MD5:321FA8499629FE3D094DBBAF25F38BCE
                                                                                                                                                              SHA1:687E1866FF87D197F3452580B742C4A63F01B7E3
                                                                                                                                                              SHA-256:F0933A81A30EA160AF5BA167E529682F3729EB3896F4D73FDD740948B1E22FD4
                                                                                                                                                              SHA-512:FBD15682B0927460069A6362D55C93E15A40E14AFF65942A5CA2804E1BA55AE6E519494B28067A9539076C441DFA8E03AD4E1E5D877D2B9F7C8ACC3C6F78E9F7
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:o.8.6.....J..2*[.....0".........G..fX..#..9 .Z.pfLf...E.-......$Q{...../......o........7.6G.!..NR^..j@....}g...c........S...;.=9|5..."E.e...:..Va7.(..M..(.x._...{...}2...&.\`...a3z..a.....a....rA<g....M..ep.y...Q...H-@..:!.@ ..... .....NoJo..@..fs.^v>......[.......76@*..R5....m"o_..q.._r.j...z....)......y_..bZ..@=...9...%.9/.N..w.2I.[En.I*........L..V.QP..q.X.#.........Y....B.....VJ........ZN$..P0.6< ...&]y...}........M.'..F/e...1.._.,.B]..=....c4.,b.C....@*C....."M.g.v}...g.....b%..DG..|\4....h...q.............(.\._..t..1....}^....D..a.R.L...]'.6{.,hjBF..g.(..S..[.{.....[...T..k.7..w],...v...~....#..r...ri..{.e....5.....O.&(s.4eTlN.8...w1...H2..6...(....nz....,..Y.F.1.R.v.G.g...s..d...Rq.....$o.0.\..u:..x...f.k...}.}.sp...].*.f. ...[..}...v=?a....v4..*b1..".]....;.=..(..&...*..w.Qiq..!...6i.F..Le.m......IL...].o.....'.....4........+...T.m.N..#.D..a.[.brv<P%.[.....v.O..w.E.H.V;r..*.G'.+yq..<2gW....bN.]...Qu...B.gw..........|&......

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\SystemAppData\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\TempState\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\Temp\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\PeerDistRepub\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\PlaceholderTileLogoFolder\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Fonts\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Licenses\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Microsoft.WindowsAlarms\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\SettingsContainer\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Publishers\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\SolidDocuments\Acrobat\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\SolidDocuments\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696334775820156800_6EB929AF-656E-4F43-9731-EA7753E1F1BD.log.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):22714
                                                                                                                                                              Entropy (8bit):7.9912691953501
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:384:51f9r/UwLYpz3NMgi+BOvVLDNih+Sw7KjGRSKlfKhj0iBVfPy+7pV9Vfq+:/VIkgpMqBOhRih+SmKjGRSKlyCafPV7x
                                                                                                                                                              MD5:E3B80D646AD761F5BD2D82085ACB3FB0
                                                                                                                                                              SHA1:4230A6E47035371483DEBD7288004C53A70B9BBA
                                                                                                                                                              SHA-256:BEB0CA36DCB29C43CDC6A5C2C0E355910F2D232C5DE9C44CF862ACD654A838CE
                                                                                                                                                              SHA-512:9E4BFC70F3741C6A1D08E211F371944AF6A0D82DF2E582FC519A29A08748ED1821A9F2D1B4F10948C168D07229906C5B68A8F2E8EB3F6D97B8D4AC48C6E527C9
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:....^..D..:.T.E.E. NxF)#t?f{......N.G....K. ..M:...G.....bjP..+...?...!.rF`]cEB.....f..;.!....P..\..S=[";*.!.B. +.&l......@j@..(.r...?....)}6$e..O...W-m....'..u;!......V.6.>^q...2*..p.[n...8..Z.~)n.(.8c...E_.\...^.(.'df.....C..&m3.....c..[........ EQf.Xc.(.!..^.J..".......-..p../..8......T.6..A.\.,_H.....47.A.B0.%&..R.d...92MB..BX..LJ.].(.E.B.....P).Z.$.n.x0.1S..w]f..x....U....AC.Ub.Njy... Kv..6..=v.>.H901l<....Ai...M.D.9.e..W..a.:B.'...|.;.o.... .-BP-kAJ..._..eH..........#D..d.pu..qn.:[...jU....|..n.4....".j..........5.........m.Xpd...q}P&.!@.s....4T.....z..3.:.o..).H.t...I].X..Dyt.@..`..~.b"Y.nl...^..r..J........2..n../...".-......d.....5..G1#.O...Y.{.`.%...K.tJ.?.Vk.w.YA.L..f...ZS.7&\..(.^.._.:.E9!.U...3....j..ezJ.../....{.=..`Yk...3...`. .IN.......#H._i...V...-..}....eS...g...g.RB.......;c%.........iq...".rG.,3.3.2.~..'......h...W....4^...!A.A'.nxusAU~..o.@.W.v..OY.r...4"%..<...W..)....s....Ti#...5.).J..I.y..Q..N.m.R.Z..M.Kg..j.....v.*q.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696334923056622400_BD966DD2-7850-423A-B1D8-7882CE1A6D15.log.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):199596
                                                                                                                                                              Entropy (8bit):7.998993716010991
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:v0gV1Xom37RFmxtIuUsnMHZp9EFPoXqifcURzVQnOiF4gsox8Kg1ZxW:LjtFCo5kEqifcU9VQO04gDyJZE
                                                                                                                                                              MD5:88B654D3EE09017F6CBA7E6E1D38D211
                                                                                                                                                              SHA1:8FE77647B8F3D6949FCBF6957F5DC287E7451AB7
                                                                                                                                                              SHA-256:F6770DE5B7FD963E323B08E99E2906F77CEC84738879DE0CDD91533E000BE643
                                                                                                                                                              SHA-512:9D5F0DEA2427F882EF7ABFFA42C216E314C9B550F7853FEACCAC57277D2294B5335964FCB1D8DA7672EAC579A27B70EA56E3248230EE07B981B9DCA079E18E52
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..<....$Ol....[.............`.$i=..NY....,.......-._C..RTAK...JKH..,b.....O.L"......Dn...........b........W.vT...(6.|..~!.B.Y.u0.s{.v...P..*.pC...2q#v....278._.]....q]...y......#.7.3.`tF.N.....!.J...n....[.u.........j....Z.._...?....`..o.pL..s..YE.G:*.U.J...bqK....Pu.......A.s....:....D...%......~.~UO'...N.G..%a=|...6.....G.:......o_.@..\5...s.,P..VbZ<....;h4..c..H..;..:pl~..p......>&..=.+{U..#a.n...Je...K.=..T..#.F.%.cL...`#.a.V0...)...$('..Cc5]}.V.r.8Q....fk..9...6...Vb..u.Fs.e..<HW.....S.gN...t..c2.h.5...,u=.1.....-w_..p......YA2....-......UdZ...c.q..`$../...L.;..g5...j.v...l.(...4T@....[~2...)...^...v.IY6NA.....i]2..~'..Rf.....Tu.e.)....}4......q..r.n..=n&/...r.i):lR..%1n..d[.;.e~a..Y" .4 .U'..(..d...$..3.k.Z..u.8......S.m8==`...1..jmhAc:...x.L.N..u~..:...t.....X.P...3.>.TY...o.....o..<V/C..b5f.X../..Ceiz......47..x.S.y8)...bi...]..#!......T.y....X.SC.]......G.6.Y.4$.d.YL;>..|S....G...........oa.`~&.+..clD.>[..v.th.IJ..WS@.j..'.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696417072488237400_C12D9B44-3468-47BC-9418-BF0A674A2B2F.log.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):226655
                                                                                                                                                              Entropy (8bit):7.9992055234165
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:6144:yKqbwYwe8BcHkOEkVf+FL0e3hLgzEBkOHYzlg:h2wYwe8BqkO5yrLgzgZHYzq
                                                                                                                                                              MD5:97BA6B92235949BCD432B03511A00549
                                                                                                                                                              SHA1:EDB7AA254D47C05927427F9EB63A89728EEBC370
                                                                                                                                                              SHA-256:4A1FDA38A213FCC880D8540E0A1F40846D3AE89AF1FD1FCA8F167762BBD7DCD0
                                                                                                                                                              SHA-512:371A34A6565E20C90461016BBD9F251E6FDFF73C1C722C1C1E84560277426E9722BCDEC6D3458782767A6B37657BE981511176D81F26B3F8BA32F88EF3732E3C
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:f...Y...a......JX......n.........q..8@.....]c...h..e..w.XT.%.....`j$G.<.=.#.zk#{re.ne>@...;c...8...S..|. ......z~.[_3...?......!.s.?....E.....g..z.m..'(..B.w..p[.IF...K....s...,...L.|M.%....O.....U.(....Hf.J....*y-Hnq.v ......{WgB.!.Qp1.._T.2Pm..}`..M.dE H.~3.....&.P..Aa....NU...)^b...[5/.2..f.<%..y.N...........3.v...S..h.'...e..c.j..E.k^p........8D.E....vZ./A.k.....[.......\..$Ar........u.k&....#.[..M..dw..r..cg.......F.....<...bue....=J....`....V...Y..S.G..y.F......<q.U..y......<....9...yJ....]5.-....Ac....]Q3<..h.n.....[G.:...&..E%.?3.J..#E..|.....#<.F..F.........G7.'.A.E.<..b..z..F...J.XvcrT.]......p.!.3P.O.@..~k.T..Sz..%..a...h.Sw..r..1tO...E.C w.xk>.td....+..\z..W....o....l.7.L.t?....u&........j....Wjv,}.BFd..z..%.]..V/...uK..>.B).T..4w#.9}[..#....`..?...3.^...-./....<..5....0..gt.{*..x.R....@...6BZ.P$m.V.e...5x.4..'..o...^..s.>P.}\.......OU.p.DE....q.m.CL....2.O .S.i...FzW0.......81.....S..A.:.E.. Z.I...\ .P.].<......iq.i/.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696417101742322600_290EFEE9-C25A-4857-9F32-D7E6D51B7C09.log.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):193385
                                                                                                                                                              Entropy (8bit):7.99908159873413
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:HE5TwI313E6NsQtzYKLGQ4ElCGNm2LgRW5wbhFFNbrlqb9EJsU6Y3itO:k5TwUXxYKLGQpCGsegRW5wNlbra9EuYB
                                                                                                                                                              MD5:EA51666AFD35F70528A2120E61EEF25D
                                                                                                                                                              SHA1:2ADE9FE564DAFC5D977D7EB923A1A26F408C9B2D
                                                                                                                                                              SHA-256:1A244497443CD4FAC7E8E17975C268BD4431CE677791D53F5BB45C718DC9ACE8
                                                                                                                                                              SHA-512:2E2486A55495C4781DCF49050A12AE1C625FE21999710AAAAA562ADB60CA725A7D88C4A2008B6AB8133E7EDD4264071604B09EE4144FFBF6ABD9FF0F70230274
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:q..Q......j...3T..k}?.fy.w.ZFZ...hM...(..j\A`.&a... .>..Z..r..4V.Q.....x..{7|..36#...i.=....X;P?........Y..4S0...d.Dg....W.M?..k.<..c...;;*.q(...........$.r..y...|..6.7.;..i..%.9..[../.Q.....2...=.)......L.H<..T|5f....i.K.....,.....g:./...H.X$C..g..".U!.....#..........<.tC...@..c. ....u....!...H7..b....w%u...7.....t......4B#i....[..&...md.... .....#\..%...#j..Gj...Z8...B.{.....S=@..Vp....Lv.%.8..O.1k@.E.1.(._u.-.F...$."J..cVB.<.^..&.C..a.r...Dn.t.K...$8....F.hfu.6....Z_.<.....(ag..g,..SrK;..9.........'.Cc.yp.....i!R...G..c.b..D5...9.=B.c.Ca./+\........Z.....l.D...bX...Vc..f..z(.z1....r..32...ga8&%v..v.s:.5r.......@..8\..m...U(>d..F.{.I..?.......1.ZX.'.@l...y.}..VTD.........d.....Z.w.....Q..WF%..e.>.,..k...&.i...p..tK]:...z{..6LT..-.....n.,......KA.XWJ..J..:m0D..F'F......G2.\".y ...2Xd%.}5.d.....-#../.l.m&JJ...0q+}..-....$.kMI...&{......>..*D...d..k...m....=t...+...s.;}...'....6....Y8qAE.;V..\_`76..D.$..M..E..!..k]......8.-.4..).O...M.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696417118050662300_8475A8C9-2447-4BC4-8E46-350AA0582B94.log.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):171759
                                                                                                                                                              Entropy (8bit):7.998790388934764
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:uqmpJ5PwQRr4kD0pxhkBaCIGfsjU/EQQqVi1qaiwmerKYBNrXnopRWVb/rB:lmprwQNOpxhzC5swQ1/iyKYBNrXnop0z
                                                                                                                                                              MD5:8ADCE5775EC2F6B9FFDB4FAD235AB099
                                                                                                                                                              SHA1:CE0D5B45BA2A78C3127B39B29C861DD3A6E2BAE5
                                                                                                                                                              SHA-256:F4A2F9ECAFD309D251F7E3CB76935BBFCF33DBECC96C0BCD203345D36D894BFD
                                                                                                                                                              SHA-512:3A7498594573396C58D6C9E39E485E3D84D49A304EB858CC84010CE420DFCE79309638277F8F0AB1E4937CF282D174F51FDB693B928AC84B3CED70E8B1160988
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:....1.T}...%..m.bk%r.^)...`X..n.F-P.d.2.pb.CU..g...E..|UaL..}.,Ia..O3).T.D.}.....|...$+D....>9.:..)F.v..>Uo.#...{.T..sNw....$7*..?.Cj.F.p."[......G..zm......6z.eDL.u(.Q.r..v....:..A]..\..W...G...T...U\.g._.<..c][^8....]..-.....O...!2D.h9..<.e..v=.\.d3...s.^.nF.Z.bj.j..0=.e.M....LeF.V3..I.......,<.@.I.Vd.$.|4....i(q.!....h.J...B...#..H..?..HRC.....(.^..yw...H(...J3*~...M.&....b..o..7....c..wI.!....h...S..-...f....I@.##(.|...h.N.:./K....x...!.. ..c".a..M..tF\.UM.d[..G...vp._.>.......D.P.%......>..3.dB.J..|....... .R.X...<..?.......N..Ff.O.l...,.$.}.f=.1J_m...}..Ev......4.Ew..ef....l.\LX..(.<...y..^B.Lh..I_.Y.GHqk..u@..a/nn..p....._.....$......3..h.. .Xb...t'P.:|b..a...In..o..H4.?.l%...x....n..S..j..M.^....TG.5.+....okQZ.~.. .-0)....b.M..#j.n..K.;..N{g.. h..._QfW..a.Z...@.9...cm&.m.....Z\Z..s..r.q.....B..k.q..*.;k.. ......^i.#..R..^W.....K.Tl.4.[.|.k^.pH..._z..ju.BR.2.\......r.....#f|m...b[...Z....&.#.G..{d..r,.n..y...y;....$F!.1S.@}.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App_1696413198165042300_AA3FCB9C-CF1A-4407-8A94-A7D6C220021F.log.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):150120
                                                                                                                                                              Entropy (8bit):7.998872975639457
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:xlTVT6N7oSU9SlMcHbYcRdMk9n1fIBpINaY8HYoAA9UNspQG:xzI7C9EMaxrpnS6MqA9V
                                                                                                                                                              MD5:619CECA9A1C632C7613226F081D8EAD1
                                                                                                                                                              SHA1:EE1793D7EEFB556539413A612B6402BAA533186F
                                                                                                                                                              SHA-256:227F1F654C57A536E3EF936C304721843D6B2EB4DB66AC25B275184A24BFCD6B
                                                                                                                                                              SHA-512:9B9F5DF739A6D2124DE42D131AB212F96B88EFE1685944F5D3C188704B542C24EC32B0FBC43E4F1EA33392E39FCBCF483E459C0426D8332F7943D9B10CBA0490
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:...A..h..}r...ATv..*...f..o+bd_NCQPj...p.<.W.|9.Y...{.....6...d....s.3...;`>Z@...^.L.'.C4Dq`.3.~...x.L:..F..)....j..s.....Y.....1b.#K.0...5]..x...<.B.Y...O..VJ.n'Q{D.C.X=..g.8m1..?N>y.!%.x.c.9c.c..5Y..]..j...=.R.b.'`......d..v_..../.......g.V.-......R.y.`.n.Q].U..1..|...a..$.c....*1y..3..l.I.9..j.tl.7a.....xM`.&.a...v...G.=L...d..evo)UQ..j%.J.G..=jI..Ek..-..7 ..I\d.[G.?rD}...+..MF.......1w..z.W.#.n.U.2y.N..F`.@yY..W.c..{......0......wZc.2E..Ni.J....sq.....g.B.[..{.d....>G..Z.M.#6$.P../.(6l......._.8SM.M..T..\.a3...o.....I....h..'..XI..{@a)8.......V.\......:=|.m5.......ck.z..'...0aa.R=.}.7b...1#@9..w..1. i}/^X.p{.p6%..R.0.Y.;tD4p..N.x?.=]$..h.4.....E..G..in...#...'.{G...Vi...?.f..`Z(.3.X..._.Q.A6~b.{~JV!.*.|..\..w}t...`..9...].;.SV...+....U....|...f.$....?...).a.)..p(...T.#....v.k...|..6.....C...,...r+....Y%Fw!.2"...Mh. ....Z..m'...n....6..'..;3*.J.v...*n6....{.AA...V..".....i.Q.C..3..a=eRJ.n...k...~...oT;...zXd.(....b.=......Z.=....J.2..

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Diagnostics\ONENOTE\App1714115799961121100_6605AEA3-F321-49EA-810D-D0DC436FF6E2.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):20971520
                                                                                                                                                              Entropy (8bit):0.013496741983525433
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:UKTpPQ199n4Bj4b4xg4J424T464B4Wog4sHi4OEY4bfO48O:UKTpPQ199n4B8kXKjM/VI49v
                                                                                                                                                              MD5:C4BEA18A78B7DD3DFED11161C55965A9
                                                                                                                                                              SHA1:56508FCAB98053FA7F170B0923ECEA38B89E94A7
                                                                                                                                                              SHA-256:F61F890E1AFDAFD61307A50C5FC8FD856FEE906D3CF151E81A88C0ACEB793A66
                                                                                                                                                              SHA-512:286765C322D512374BABEF6D505A9A2818F616A52506C1727E842C010ABA627331D0AB77C842309912B84611720A4213D6C30AC783E2ADB731B45F4D24AE0FD1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..04/26/2024 07:16:40.277.ONENOTE (0xEA4).0x154.Microsoft OneNote.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.LoadXmlRules","Flags":33777014401990913,"InternalSequenceNumber":20,"Time":"2024-04-26T07:16:40.277Z","Contract":"Office.System.Activity","Activity.CV":"o64FZiHz6kmBDdDcQ2/24g.6.1","Activity.Duration":407,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":false,"Activity.Result.Code":-2147024890,"Activity.Result.Type":"HRESULT","Activity.Result.Tag":528307459}...04/26/2024 07:16:40.293.ONENOTE (0xEA4).0x154.Microsoft OneNote.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.ProcessIdleQueueJob","Flags":33777014401990913,"InternalSequenceNumber":22,"Time":"2024-04-26T07:16:40.293Z","Contract":"Office.System.Activity","Activity.CV":"o64FZiHz6kmBDdDcQ2/24g.6","Activity.Duration":18017,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":false,"Data.Failu

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Diagnostics\ONENOTE\App1714115799962036400_6605AEA3-F321-49EA-810D-D0DC436FF6E2.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):20971520
                                                                                                                                                              Entropy (8bit):0.0
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3::
                                                                                                                                                              MD5:8F4E33F3DC3E414FF94E5FB6905CBA8C
                                                                                                                                                              SHA1:9674344C90C2F0646F0B78026E127C9B86E3AD77
                                                                                                                                                              SHA-256:CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
                                                                                                                                                              SHA-512:7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Diagnostics\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Low\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Symbols\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8547570
                                                                                                                                                              Entropy (8bit):5.648821413579243
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:49152:ympC51IRR9OPKW0ANge+q80Ibxh0T4tI6lIfKi5YJj4vgYBl7V2tuimPKu1ZKKOJ:rC4cF1qd/Gvl7V20ikKNJ
                                                                                                                                                              MD5:2A9F4149C2A820BE943C84DC315ED251
                                                                                                                                                              SHA1:F1D149A7B6F7CC0078CE64848EA77195B5D80C1D
                                                                                                                                                              SHA-256:3002B8D42981A9080F40686D716DAA4757373562C7CF822CE78BAE447271F5AA
                                                                                                                                                              SHA-512:CA3E3A6AFB433CC97B04C7C41DEC48C3D282E59A7DFE630956694230B1D795927A6B184A16B0A5D3A30CB5E39AD374DF204EDA2B5649478035E223BABDC53C2B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.t.t..@t~[.E.R.d.....[%..........F-.A..u*..5..j.].}'..[s.......l.Zi....D....A......b.&-..:.?@.....U.....*..%.ZU..5..b.X*..E..../Q....<...R......7...D..1.RU..y...|....8..._H...g..7...V.....8V..2@a..n..f....&.+-p...v..0..Hs.lj.s..\.N.sL.fOPh.r'K.....dY....F..2....tk.....m. ....B..&Z.3.."}.......2#b...}..wv..{.8r..~..e..eUHs2Q....].....w.z..K9...t....M.......Wc.p.f...>..m..~]....>}e%=I.(..4y,i....p.(...).j.Y..m..... .Qd..+l..D...n,...6..$..iH..!sQ..[..8......C?2..l..r....zv..e.,'.k .......P....0....q..d..v...y..}D}.i...w.|....Cp.'.......k....wj..Sq.f]..a$.....^FV.k.q.G,...k.J.._L.n1.....h.I5.m.!#.W..^...d......".......{..kcK|........L.....>s..FH...^.=..]...`i.....=....!....K..<.....M..v.Bo7..(.T.qY>..[....<T...V........$.....[..h.PM.....J............'~.....}......zTc@....c.i.AS}B?|..%.-r......8....w.-...y..RVUS9y.%N.ycs..r....'...P.X.....*.#BR...(sH.!.$...M.UL.X.Up.5.p_..g.:...@.g`x....rb......D...'..L....7....8.9a...Jl.;4..vv.S..

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1192178
                                                                                                                                                              Entropy (8bit):6.674183821664332
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:9BP2U0pLB+kzNiS2WaYWdu8nYLVXfafi56+rmxJo2cvXtu:n2U0nZiS2/rQ8nMpfk4prXtu
                                                                                                                                                              MD5:FBBA46E75EF6025A0963676EF1675C61
                                                                                                                                                              SHA1:4DA92AEB672A222F412ABD1BB253C95AE07D7835
                                                                                                                                                              SHA-256:CD9ED7658FA42B4404F24F5C25B7BC82548DF56F845473BF4F767537608058FF
                                                                                                                                                              SHA-512:1CBD27EDDA1CB235A690001F63A917FEA2D6555C67FBA8DD15039D93767CB6CBC42B1D44D90A7DC73EA9710FDCFA904BF7FFF2BD60A8839A2F38CB0C98ABD799
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:E..r.eC........l...<m"..]...??{2..O.bW..o...F....G)...%z.....I9.X..M.>...,!`yf.(.)9"..^.....S....h.)..|..Nl|g...g.k.....Iz.S......'.....z..l-..G=..Y.H'......D....\.....&C.u.Dn.C..(...Y`..7....M7...d>.8b<Q..o].Y....FI..Q...eod....."BG>.yX.q...+.8.,...:..i..Y..{.h.!...c>..G...Z.p.~.?.6.>........J);.7A....H.e.NH.......v...5...t0.P:....pT&.b.OD1....%...c...S..?..Z.$....f....v%.O.u...'G...F._...`.m..c..%....BU..r...}.Ml..<..Z.!...sv.c.N.....wo..S....'...>i..q.].P~......|9.c..]..C7.O.7.r..Ert@tR=|.#.-....IAN.q1..;.F...$......>..U.;.9..g.T|e...N...{..H.Y6.G....o.....'r.a^%...B...z..o.k.hC.GQk.....j..YCb....o.yD.-K.F..;C(.+.j..N.\.*.....1)..Lu.G.A.(M...?t.....-.C.._..bJ]}Rg..Jz.D..N........I.~..A.....kN.....t.]T.}2.)...{{...........4i*..O.H..k..ouh..4........9G.o.!......_@.1.........U.>.3.O.$:M...$..H.{(..b$x.Yq.@_/-.............P.....E.$...x.S.F.[..T.$%[Y.%..I\.oV.$..%F.z..e`.)U3...E.M..v.#e..:.1..e.j.`...m...k.A.>{..7?.B.\........yW.E.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\DC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2023-10-04 13-00-50-743.log.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:OpenPGP Public Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16812
                                                                                                                                                              Entropy (8bit):7.990774741119476
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:384:TiwxEBnQYmHBnuVqH6GrlbjR8HCGXDW6VK2odB95QbUG6AGF+:GoyQYvVqH3rlnR8Q6kLdNQBh
                                                                                                                                                              MD5:091BE1DDB563C61D9FEC36BEAF3003D4
                                                                                                                                                              SHA1:5B229C4BEDD62545D4EF08721B268CD560250711
                                                                                                                                                              SHA-256:7758839208006DE2DB6C17885C055CF44FDE030900421047D03E4D23BE26E5EA
                                                                                                                                                              SHA-512:0D0023DCDB9D29687CFAF59483EC2BA1D160B5AB0AE0360763DAC45F8BC4C4723B0B39DD77DEE9E5D7A1D3F64B2C84717DBF83EF1251D2B16326C86A277976DE
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.....9b.!.[w.W.%.=..>'..a..?]}...t.9.X..y......Y..3..d.....#.x.....5%ws.K..}@.{..|..p......,.V.$.....)..}........U)....#..p68..FF.X..Wh.IrW...+SG3Zp\d...A...?Q^.@G.Z......~.89......S....>c`Ik...i...C.a...c.m......y.,.4e..v..2............^..........ve.\....9$.s'..}e#..G.b.)/.[.K........v.&..e..o..g.......k...^x.J......a|..^...8....A...'......o..........X.........=..L.2<...mBN..J.._5l........ T...m..a..Wm..m.. ..l....-..z..?..x.......:.....?....q...S..OS^6r.a.".d1$+.....I.f.............m.^Z..C.1....7.......>8^.8..lj..c.T.o....y...s.G4z._=V.QS...%... .%.oc.m.+.6W._..~2'NA..X.Cxq..[P-.._..^...w.+.F.`L.Zo]7...@.N.;?SC...Y....@s..a.....,...V..[....c..a4 ...w.y.EF.!..&.E.".v)....:.&... :G. ^....`. V.gM...g..U.4...P.)z...*.....Z..O.n.4=...Hy*...H;BQD.9.V.. ^.B....s..a/<......J.x.K.D..@..1..p.3..{QY%fhj.t.s.Llk<o.(F).Y..UuG.....V@.........."..I/.I...U.P..X.T..n.?.~c9c.<.Q..R..i'..*K..q'....!&..K....W[*.\..[.KvH..*..@.E...s.$S$..1...(N./Vx\7:.cD

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2023-10-04 13-01-22-078.log.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16806
                                                                                                                                                              Entropy (8bit):7.989146363693379
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:7+O6KACGUwkMGQEZYh9tIr85uuXS2PkgA3LvlMBq52l+RJUaJ+:yaGUTfuHtvPIg2vaic+dc
                                                                                                                                                              MD5:C8D216CE305D2233425E394A5493DCA6
                                                                                                                                                              SHA1:3598A352A24B45F741BA98484664D15D45AB1955
                                                                                                                                                              SHA-256:F1D2F3012EC1D6ED7BE6587020B72B5FB5D6A2E1F1D47468B57060F33D31F1BE
                                                                                                                                                              SHA-512:1E1C86BAB16A13B3C7CC4D355E3AFB6FB944F9EFD4895FB6649BCA8D0C3667837425CBFF4D372F42F1401F12395288E5256CFB98722DAA73B5FD7FE906D9DBA2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:~...n....Wb..$.&.+.8...t+b~.Pu.t.;.N..LL4.9......FT.M.Q.}...L."..7.}...0..p.I.$.... ..).?.+.....F..-..N,...{P%.RE..Z.V...x_...3r..X...N..".6IAs`\.$GE..$d..f.c..~..p...b.)..U......#2 ..l.#.^2...."2....[....v.$.LF[...^B.......8.....D_..w.g.../d..........7G../...\.....I..=.plTc.D...Gi...>.........c.6V!..3.~D.u.*....i%^A.-n..0..1.M...'b.~..v.9......vg.@.....y-D...s.2F.?0....@8.@:....w...5z.N./]..-...p.hD)..+bx..%sClg.WI...P\.R.........bsI+..8.b.cZ..l.s.......V......<@Q..&.I4K.yS.)O....V.eL`ZX..U.j.Iy.wk..lE..^.$..?8L.e..gd{TT.....]v.'.^/.x..\.f:fO.ay.W.......~...)S51..-........swHD.u.. .G..-,P#..)..W....I......P1gE..7.i..d.>.;@^-.....=......Lu.6.6.4(Nf..b.$X6$.K.19......kT0...?S.|.8d...x*w.f.]...b8P.........-<..8.fv..s.<}.[...g6P.......O.....D\..w{.;@.....z`U)....[M....F@`<,HcO...W.z.....pw...?.j2q...e.4........I...?.i..&......=.A....uH../..Z............T.<\..:.U'$%1:.._ ._....'+.'.#...7qW..U..)..6Qn..j..s.{_..T.......2,...I_....V..Z.8.+.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16881
                                                                                                                                                              Entropy (8bit):7.988856104047958
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:7aoXrtxmkxcOGBWzK9H27QNf/y0vmEOJz+pbX7LwgaOCW+:7aoXrtxv7GBeK9W7ejOJKpjwgsd
                                                                                                                                                              MD5:569D8279C35A5BC414682562440CFA29
                                                                                                                                                              SHA1:E3C78876E16D825E24F3F84576F695F1F1097DB0
                                                                                                                                                              SHA-256:BB588894F3758A1A1EF3B3E9E89B43E3360C07419084B4D265A6490B2AF3BDEF
                                                                                                                                                              SHA-512:0EA0DE96683CD34046E2AD808ADEACB3DCA2765346626685E9EC45FD790B45ACA6E3DAC71B2497A4340FF5E05AB8E03CB0D7D7DA7D22E65B0E1801CF50DE22A1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..#kW./.....fy.*. .....z....H.Z.6...S....zE.D.p=...4.u..`.GX5..r0..O....K?{..u]...W..|..>...m.w.:.9..[:.mD..#._.,...........Q/.5=.A.[.6B..Cn.4......X@.J....3.G..gtwp......V>.0....kC.4q...O..;.Vt...u....XJS..0..6..M".._.b.)p.'.....[{~.G...q...c.....`.6..*.w.;_.{..N...........H.i..\......]*r.W...u.x..}jG.. Q.E{..R.....q..OW.Y.!h.:[iI(......~:.V..b.w.........P....5.{..[.?{....)?mp.n...w....S?Z.{.M.|F.......6.2.....v.G.].6.C...V2..)...c...1.&..z...-.(.......eg..........7<.+.h... t._.N.n...z..e67.F..t.kP...Kl.7H.<g..T.}p.9.............I....O<.I.+.R.....h...cp.........5.;..[K.Z.K}.rp.N..........y.^W;".r...i...s$.s..<..8.-....$}.\.zD.W.........!.a.%Nb....0#.$..3i............s.M.. .\.&s...PT..`.H..dW...L..5)...G....R....Q....t..l.y..W[.]...i....-.....3-..tw..u...9F..I...x.<..........^.Y..d}.8..N.$..5.f.)o/k....l.....wc).."._....._...?.#L.>.a@.............h......Y...f....U...a^...h`GA....'.9.f}../{M+..rs..F......NW.?.V....q....<

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):24119
                                                                                                                                                              Entropy (8bit):7.993341620087841
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:384:ay7pSTikcWBEPEoN7hf5uKCygeLcssCCB8lgRuCggCBY9X3fr2Cmtn13+:a6425PfNh5uUWZCW8uoCUY9HfiCmtE
                                                                                                                                                              MD5:B1CAD4D42E338877F762692A82BF7C5B
                                                                                                                                                              SHA1:233479DE8743CE3D93177A38484784DF5C9FC607
                                                                                                                                                              SHA-256:86B2410429966E43291F6DE27A50566503F5AF61EA66A5BB1CA5B88E4E68CBBC
                                                                                                                                                              SHA-512:F2D0A5EC2E758AAF651B17365E3176FC33A29C4852E52763C391ACA1B12EA1CFA634F594B70BBEEB71114E9F330C06B7A6A7563F4328491B37FF90B9F64E9058
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..m..N......a.[..4...7V..)..B..*....K..C..r.G... zAa..A...@;/...2.....A.../;.Do`..C....&r.E.X..2.AW.[......=Z.lQH/..3...w.YI_.4$.a...B..j.....2f......Y...kU.,/.>0..;.S..)X.vm.{...fS?...^.E.&h.....3.g.=.<0.~..n.).I.f...(.....!...W2j...c....<~S.$$.......49.^.Uw.&..;....w..4\.`..O:8...s.....~............e.o.L.V.\V............d...m24.".J.......".=.e....x..''.1s..X]....(...........lM.t'..]2.3.e>..IU..o.......0.$h.....N.n..$H....m...ay......h.}g.S]....Y........t.KY&...w./g.....mJ.....VWt....k..H.j7.a4G.$..... ..D.hgw.}..[..Ozqy......kh.]....e-..L...}+.H.i{.......r.....{7w.....k..-...2..9.....M9.&......(1j'z|r..'.q-4.....$R.Z..+.P..).Pg.....B.$.X<I..Z8c.0.....c.d..8]..!.rDX.......}..a..r=....+;?}/=.a.T..`..};; @.Q.$,....f..|4#2p...'..#).q.n..q.8O>.).*.U...IJ.s$VO..X...c.PF..$k}.8N:.sl..._..jc.*~.W.2.u.n..@..qd...........O...]....o....Fg.Gg@.$.....i.j..C7..?y+..~.P....._..l.x}..%.C.......Z..<..].D..u\..V..1.~....d.*.z.r-...[-6\..&..;G

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\acrobat_sbx\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\acrocef_low\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\SearchEmbdIndex\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\mozilla-temp-files\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\prep_foundation_win32_bundle_V8_perf.cache.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):661995
                                                                                                                                                              Entropy (8bit):7.81070642098699
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:ZnVJ3xVR0uEkyDC290MHrlOMbqylRRdZt3zGNDzDMO:ZnrhVSuEW290QrlOMb1RDGNDcO
                                                                                                                                                              MD5:2BC1E2DDAD5871A5036A9458A0318CCC
                                                                                                                                                              SHA1:742E55AEC4A3159B4E0AA689A51E14F48C28DF6C
                                                                                                                                                              SHA-256:D8253EF7E64F08308233FB6DB94E253514935FB17BA0A2266829A576A69330DB
                                                                                                                                                              SHA-512:4F2DF1A3AE71A651F89D0FA5260F7F7E8B39203702A84346C50235F8D0965BB9BEB73DCB488B77B7823A4B38D6D333D2B0227F203CA29069D57E0489EAC4F0E8
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:`.(.[.......q.$.w.0r}..6....h..b.5.1.....1.er.J../.....#.4.~....h....V.2..*.....k..Wmj.).....5...>....yW-..i...@....n..H%w.;q..$..o....v..&].[..A..6...Z.,d.Y.p.kAu.\.../Z}.._tM...M........Y.ym.9>}W........A.....;.........l.w..&v..D$..\...5^..A...2<G&....*..g.F.5I..T..+.y..}....h+<.......~.{.....l.....wBhr...C...u ..X.1c...>...];.~.....TL..y.'bn...z...s.u.v......V..O".3F@6c.>0..e...5........}.m.......Z....gD..{.]...)..L.g..UO.?..~...h.N8$_..%5V...q..J....Y.y.k..kz.._p-|.....y%.&.K..'.P...<e..S.D.h...h..+.n.Y@....;..A.L W%A....eV#.T..p........=?..."........]................=.R.E.@......qodx.64(....#.m.U.]].&...Jo.T....zMdXy.X.o<.....(.^!..........~TaH.D:.. ....`.JL<..\D...O?W........F`..U~.....`n.,4....s.((.$RCUJ..y.G.....(.........n1...B.E....b..e.2dc.'...t..T.nS..&.h...p..^......7_.*.>+...A.m...#.(4.-.._F.0..sn...\...w.W.....D.o..=e.&n.G..c9.[.#.F..O....wy.....;|..u8../\5.............-A...X.._wZ",)a}v...m.<.zj.R>....<.J..;!.....n.w.9.L....

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\wct38F0.tmp.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):74446
                                                                                                                                                              Entropy (8bit):7.997751583385029
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:1536:J0mv7iT/2HoswvM1HeeB/tqYwlsXMyD9cAOIL4DFdqypqlQZI1dXTTH:J71Hem/tqYLcy4IidqypJZI1Z7
                                                                                                                                                              MD5:40488BD7ECE20CD25A24BE3FEB55B7B6
                                                                                                                                                              SHA1:0D0BC41C64783F1E6CBA13C411A9428B9A30F0C9
                                                                                                                                                              SHA-256:D75A9D2EB8A816A4FAF261EC37D8F72B36FDB8AAAAE25C90C8C55D1E287E5316
                                                                                                                                                              SHA-512:64C313BE04836AA2C675BDCB14C69F0E74200195643A18C151E17CAEC95E8FE9A0B5AC5D2CC6E276D8D301E6C5C5B861D0AF10265F9EC22B044C873982701768
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..m.....N5.b&..............~.n0...q.....d..O..~h......4<tA..0..T.3r.M7<..yf\./.S....Y.p.3.F.6..........Y[..9.c..[........]..eNR...4.....h_.<.~..rQ....+ ....Cdd".af.\ve..._..q.On}.x.=... r.."....*..CO........D.m....1W...M.Z...B.n......4..k.%.o.R&p....P....B;.'W...A.R.t.!......~.w..cL+..2..i_....l2?KV...j..%./{3}el....w.i..U.7.7.....=.v./....>f.`.p..DI...co..NC..?.?....D.)(...it....!S.`g.ho.......K.q...W....W..C=tk.!.0.....6....$0..>.v..(.Yqu......b0Q..T.p....\.5.MR.I$..r.....iV.V......(T...i........../.wN....r...Ej!.s m%|.%#.....s'.&.P.....2....w....4.[..z...!.....j.d.W8...-[..........N......d...!^%B!F...K.../..j.Bfv..&...0.&6Ow..'..P=.# ,.%..T.....[....ASx.[......[...~@.3..'S.0!Qy".3.!..A..&o...F.}.g....bD.r$GV.k......B......iF..@J.N...^..f....Wx.X.&.I..%0..<..}...`.H.g..q........U...E;..i.....u......x,.......Z}..a.aB...X...%.d.n...._7X......~K...R..].;...pj..+u,...(....._...V.r.fH....1...r<J..&.....V.v.....y...h..=.i4.p..,.Pz.SEicX@*.$.&V

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\wct3D66.tmp.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1601102
                                                                                                                                                              Entropy (8bit):7.987433094796985
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24576:hfNBoJXsBYhS+rGPxw9yMCCg83udcWXDYajPF2410wuRpGfFki94qSe/wsNfzUz:KJXsahS+6ZClgQu3TPZ2psFkiSqwozG
                                                                                                                                                              MD5:6D254807C061919315D6CFAFA1449346
                                                                                                                                                              SHA1:D97081D8C4B34454E7661D0E1BC7C451C2EE44B4
                                                                                                                                                              SHA-256:4102238FB5B57BFAE55DD8ED180752F5AC1897D0EA5D75D0719CBDB978B28057
                                                                                                                                                              SHA-512:342C5CA6AEDE192DF5F14776E6A2DEB2CA0F06E1AA94E6B7521914257583B2F0703F0674D672BA2F142AC37B5C7BF459F3DFD169482BD25DEA4515CB1EA6C0C6
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.t.HN...5..V..*... e...#..0.G/I.L......,.J.`j..............<.....~..~M..u?Y7.$:..<.;O......9..=.....z..Cg.j..*..T.1.......!R....]....2.Q.C(.......m.U.E... .L.P.A..t....^//d..~q...2..(`...P..Z.....HX....m_..Q..F5F............Q\"....fgp].q../....|.#%.#..B'......W.V*r...T.h3....9.@a.9a.~P...+G.fa..A|.....4../.+.;.An..~...f.V...V..3.pA.......X@LSo.J...~)..?..qC..C......C...t.>.*..7qV..(..*N.........jy........|d..2.8.z...n3K=.Nu.\.k2.q.|nE^.&>....b..8........~"c..A.)..|..y.X5..2?.d.;=m..9.d.[t...:...Z4!.<.&]....3k.]%...4N......4.....T...$.m.=S$lsj.....L..K.3...%j.....d.Dk.W.U.......Y.}nv...dl..d..@o..rn.......2.....q.GL......\..K.z.......`H6wsV\..Tn4|.{...y.(?_....y....S......!.KcQe."l.Wy.y&}@....^.....[.d....c...K.U@..s......w..P..i.FD.\.f:.=..]/....T%..o. ......F..s0..J.jz*.A..E..T....v......C..<[....._Z&Dl....K..O.G.h...P...~.....xwFY..Xh>#. y....'..4...FM.w.!.......3..='....~F.+0]....D2U!...\HF.BM|q9.._...SXW..P....D..>..H.......

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\wct443C.tmp.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):65092
                                                                                                                                                              Entropy (8bit):7.9968437858436
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:1536:abvO1VFEzSG7wSDZRO6pNrVxtqJxqGau2utcBSBivtP4gQtjKdXF1f7aW3U:aTZSkx/bztSaFleudXF1zZk
                                                                                                                                                              MD5:075C0DF3E0CC2C907613886B58BBF38D
                                                                                                                                                              SHA1:160C9E4D46F51F07252F37DDCE582A46A9E778A2
                                                                                                                                                              SHA-256:A0BD1A22CB7796647F838860046E5992BA009586C2E686798574A8234B0C1542
                                                                                                                                                              SHA-512:E86DD5131D354D1652B5CABD1C18F53853FFAF3FF5778A9EAA43DEFD6CA28A0A5C0FCD6EDD75038E8F9B5288FFB566E32E3F57E12C3D4D306C9BBB714817FD72
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.!...,....X.F....x...p.i.t.tF....`...#......U.t>qL?R.C..B...N.<........j.}P.........t.:~e..F8.V.............s...b..H.....m..0qI,....x....8....g.....s.K4..H...L_.t.j`........;.'.}...|'p..G.@..]f..'........r%.9.C..........O.2e..^.I.=..s....|.o1.q..9z..-../.3.......q.d/.....L.T.u.JD.Q..SO.].....'.......<......N0t.8D?..S.-,E.rOk..6..q..jm...<....r..w...&{..v..d...;....6.(.-..H70....3.|....[......JagX.?..D..P7.i*K.....Y...j.R..H.)S.s..162..q/.c.S>\1.......!........%*;.m..U...x#.(..S.^P.3.......W....;..Ox3...KR.2..Q...Lgy]..j..9...h=J.Ps..D.ZFD.S..t......]6tH...B.!Y.;.....%s..".4.......+.Y.\d.LZY..h.s+f>c..=.bI.......G.".\.c..$..u..d....P&J!..f...qF...%...o>..K.L.....?[...a?..Z-..o.WYrn..x\..GO._\.Y<.Cd.X......K.....*....-.J..Y.r&..p.O.>R.j.Be1.6G%uW=\,....e..&b..e...Z..<A...~...[hD....v....2....G4.......L.......dG.5.d....y.}......CP(]{.q.Dy.4.\X.......}.8.q...ab.n'.o......p(,..B[S...0.*B.j*.J.<@...p^0....."r....k...x.f.G.w$I6;.}i.I.y......l..

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\wct49A7.tmp.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):65094
                                                                                                                                                              Entropy (8bit):7.997047153096026
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:1536:Mhshhl6qBJzfQpSY6W6pF0Wd/hjpoHvrADnNRb+mGcB/aKiSIdEid:Mh86upIpS5Zp/FDo6KmGcBSlS5U
                                                                                                                                                              MD5:5CE355C9E1DDB810C01D5C0AF66684AF
                                                                                                                                                              SHA1:7AA64A2F97280D74A7605694E31DD294EBAD0AB4
                                                                                                                                                              SHA-256:CC06269CC8BE3658F33D56455B551A9C7DE690B7AF9F96A296550AF760842C1C
                                                                                                                                                              SHA-512:44E6D6A9463551B064E35E1C521CE5EB2F3FD30E9ECEEFA57D9DC7F6D222898F3B776F3917A8593E9ECCBCBD601A858E80D6FA0F737B23A2D407CF75D6CB06E4
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.Q.....j...Hf......C..XP=..g..q&...oC.[..y.N...B...Y.!8...K.O.A.]\...H5vk%.2......x..r.j.,~.4.......q.{.)a.4|.~H...kUJh.9.8..3.:v......b.}.?G.:..;o.rz.....Y..I\...u..cn.}.).&".J.qY.R........<..7.w..c.....P.\.0.IW).j...>..7..U.....~.&l.a/{.Q....K.oa...r...4./#.aL<e....Gh..gv..O.....g;....c.....T.< . 'Y'..V._.O<..\r....;.v^...H...9......Ksa.B0.....!...(.......tu.4......SG..i.9|..`U..4S-....)....n0.D..m...frGi...A..L'8..i)....8y...V..,.J.{...a..w.#lF.go.a.|^z...$.6.....<.$?R$&_.......oE.BY.^.g......].K..TY...=Z...y&.Y...Z=.. ..oD.1O......6.&4.f..E.QN.2`....!LF.d.6...@..3..o..K...%#V[...}nrQ}Le..?...h.....\........U...NQ...,]*.|...c..i....N.....{P.4.I$.....nt?^..y C..7x0gU.~x...X..#...SK..1u.n....O.0..........!.dI......vSr.J. ....#...;.c.%83.3.....x+.[.F-.c3b.".....b.=..(...=....Kj..\..p...&._....s.6*T4.\z.I....Z\....n.:.!s..zC...z.y.r...o....g,.4.*;J.gJ.o......9.t...R..~m}.?9u.G.Ef....7r..".[..B>..V..#..l*1w.s.(|..t3.. 1....v.L?_....

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\wctAB5F.tmp.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):74431
                                                                                                                                                              Entropy (8bit):7.997646390518691
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:1536:b6sRg3CS4qBNffTamyzbOnVxwxORSaZOmQzkORTGz3RHpb:msMT4qBNzaBe4xWZONJ+pb
                                                                                                                                                              MD5:7A4E7C090F09E42DE941EADEF6727420
                                                                                                                                                              SHA1:C765C4578D2A2F4E201EFAE20A0C652C08A247C9
                                                                                                                                                              SHA-256:C28C6EECE753C4FA489FABCA1CBBED15B1AAF606A999D51269C62C3D749A7DA2
                                                                                                                                                              SHA-512:AB33A3322778CB0C93768E9E40A69E39DD6F0DDCA4BBEEAC3925A5A24E718A8F47B4E394DC014EA0E5926C2C5611B8133258BC51BBC71989E5FD9865CC0C88BD
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:....q>.....1...Cm.Z\Q/.pP]^L.....O~......t.5....s....G.?.R....l.-.AWD..-....B{...........&;j.S>E.t..........(.&#..'......I...ET...!6...yS..`..H<.T.3...v.o.[/....f.8"|.F.&W..../.;V.UluP9....x..?..R.H..../....x..A3....8..P...:..w...2..)F.,x..;..9.#..l.....J5.).....>.{..L.h.9n../.T.......`..!..$...P....~1.@..F.O..m..,.O.*s.5......e..t...........j.Oh#..w<!.X.....rp.-..-.8........~4.."BV...(.`.9k.....y=".? .C..\|.....A.]..M&y..5...X...".Jb..U?};....M..GU./...w.\>........s.yt...Sw~_."E.$.f..s,Q-*.9.J..TE.jT..!..W...b.TW..p.*"..Y....Y.....B.qYN7...#.........3....c.......[.,x.#..<...{J.....T..C..}X...4...69..C...nE.y.q.....u....u...$u.~...rh....>.....c.o.N. ..|`e...>..3....hD%_.[.... ..I...9`JlY.56......z...T*.R.K.'.|..y..c$b..@...T .....^..k.3..u.1.B@8E..Z.$.,.:..8.kg..!X..d...^|....t`b...k,9.iP`v7.t..X8-.jX.$./.....%..wuz..4..@...S.[Q....IN...S...R.$)..!..../.l....j.b..j....O..H.....>..o-...N..I._.K.>:..%wH..K,.L..6.Z.\.rI.......'y}N..S\..k8.=.k.n3.-..3T.Ur.X

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\wctDB2E.tmp.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):65094
                                                                                                                                                              Entropy (8bit):7.9971759904494775
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:1536:3NiWWyAxwJl3OS2bMgREjQn8iX+Mx8Tdsc+adk:3Ny56OSiMg2jQxxed1+d
                                                                                                                                                              MD5:04BB889561B1B312A47C2A4E95CE7B28
                                                                                                                                                              SHA1:E2D41E1170CDC20E722A0C5A9A08D47BE01E9A58
                                                                                                                                                              SHA-256:4CE9C74711DF3DFBD8946968E133B7B762FF88E3794F62917A46E4DA754CC675
                                                                                                                                                              SHA-512:7811DBB4E7434A1ABB7D9F2679B612E75CEA5A6A6D8AEB9235FA65EFEEFBBD0E0A99AC91A5B0F5C685DF7C49E4DD45370533E71406F44B30329C3E3A32ABC0AB
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:....f....N'.1...7..\.j..:......2.\..'..%.U.@.b..|%dY.o.,.g3....j...G...\.....+6..7..mU.a...)...G..N..jpE*i<..fm....]..z..TBG.#y<..M.......K~r..G.41'.}.(.....8.....|..| '..,.?.....U..2%.B.$5....m....H.5g...^a......F3.vd..-.s......1U.eJJ....4.t.HS".0......*JJf..q..E.B}.C.. .w..c."oO..%...|...Lt.H>..........,. .,..Y....p.....]..S...T]..A.<[UF..f.f.h.....T.-..qN.... c....;7...>...eM.e.[".K.{r.....|...$w.H...X.$[......{.W_B[....../.B..E........0mb..`..,...]....003.LT........~.x..G....n9.v...}?..J......V.njv..d..Q.$.Y.@..].G...5.j.......x....J..*....M.....W..dv....'I6Mk;.($up.9.K_..=G..L.R.r..Z...u..*...-....Q%....b.`..hx....B..[!03.w..V...x.[y....M.....u.v;...N....B.B...{u+3.}..M.Vg.........?..RN..td..k..;.....\[Vd...._.eF.j...=.....#..,.5.pj.R.Bh.T..1.T. ...(..A.........1.#..8./7...S."...{4....vMZ...B.V.....dU.E......KB.....o$e.$.W.w&.7Q..;......y#....v%f.f.?`.....K$../:Gt...B7.v........El.6.....*S.de...q.*...0{.1.'....W%a..p......x......|.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\wctE4A4.tmp.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):74429
                                                                                                                                                              Entropy (8bit):7.997778473774284
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:1536:klbui00E9AOwCJplMdXRLyl3Pqv2m7qzEUTiYx4xOthk5XnNNPOuaZ:klyi2AWSRg3Rm7vUTiY4xOA5XNhOuaZ
                                                                                                                                                              MD5:34554A1E45442CAED41EC7D3643EF53E
                                                                                                                                                              SHA1:7DE7AE98F2F0E199A305C2651E3867454CE7BA92
                                                                                                                                                              SHA-256:7E39403D11BEDF01DD6A679031727E5DD9D1983E69D848274FD28F6718286B6E
                                                                                                                                                              SHA-512:455EB37AA88FB62D07E9FB724F4B77955E6489D9B0D66A8D38C67E81C72E45FBA3EABD96D1919457C813B754C203331490901FB48B57EF6644DB67F03B105C8E
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:y/.....$..N..R{".X.=N.Xv.u...=.W.'....^~hOU..}@m<m...vu'.....9...@.f..R. ..v.t.*.F.J..I...e.y..J.T.?.q!.P..1....\..3....ou.....m...BQ..].....W.e.....]...Hz..T..w..k.I1J......e.a.l".Na.2&x.9%.ZrS...-3.a..I9sX.s. ^'..).`.Wanf...j...o.Pv..[9.1......:u...;Y.......+ut...r....v@sXxDR..@7W._.)."..B.q"....G.%.R....Ic.....f.........n.a*@Q...<SW.w.-:...X...1..,..N.v.'Cm.F...diAM.6..cS.a...I8Q./.......~...Q...Zx...W.;.S...|.K...'...$...d>....Q.Q.$Aoj@...;.....v...zn...,y...^x.HW.41.0`..X|?....=.$p..=..=.T...].N..... e..V.........9...4{.T...-~k.>u48.%....OFNm..k.kv..0..4...Bu....z%...<B.......u...Z.w%{s.i..wf.2...W.....p..H..>.....-...v.I....i.yF.9p.C..m..G.b..sz..'.F4..!F..9k...3j!..)E|..w...:.q{i..Q'A..q.?.zR.:...fZ.>.J......xOA.jf...Vc. t...P..i....!U.*...v..y3....S.f.o}\h.@,....J.G0\.1...tl..S...7..N.....O..~H...M.h.k'1.Y.`..)..j.TZ...gp..ek.Du.c..[../.^..c...".x..K./..s..R...=.)f..f.p....j..WJ.dr..n.`p.K....%.....<....^V.0#...|.K...S...i....xM.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\wctEA40.tmp.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):74446
                                                                                                                                                              Entropy (8bit):7.997287433639446
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:1536:GbfXZHYG7IpetVSX487xLNkg/fliV2ERwXJBGLhCIb7inGy6u:cXfvTSX44kgnl026eShl7vc
                                                                                                                                                              MD5:7EC38A66DEC4212F130336306717AB85
                                                                                                                                                              SHA1:84609E54DAF4A1DE5AA7B3848C80906C68CCE0D9
                                                                                                                                                              SHA-256:402B84E38C7CBE4EDF1E0047EDA13352F4EB5E8E3B295B6DB7C3AC386E0BDA81
                                                                                                                                                              SHA-512:02F959EF38DEF8E3FDD294CA1838FB92621AC8B35DADF2F6827B332CEE8E866388298CAC2380B6D2C162DDF9C4EFC672FF440AE1F6C1F8D5461D300E215AB42A
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:....d.~..........Z@.L.v.......X/...O..{.TA..O.....,.(.8'..={...~@q . ...."..z.3B\U.|.A.E._.Fi....5.QS..AO.5.2.~q..b...D\ v.(.I.........R....K...~..z...[.h.D.gg..s?x.g.....X.....I....H. .J.....^d>..pw.Hu.CN;.\L.B[:LA.....a...G..\..f.:........eP..&o.;.(xM..B.A...K<Qo.....%...E.(Ya>....?.2..+..H..\....(...~.Sh.6...0^4...)8.r.....x.^ k..%..3.i[."..y #AB.z.e.........e...c.`.....$...2....(i.Z..x..gQ.n../.(..D..j..._........jA..R...)..\.cQ.4Tt..5.?+o.e.S3].}...q5%i.w.d.Q.:.n..|....1...\D...~<...I.&....a~.....|P,4....$6"...0.r....[.Q.S....h.[.oc_.!......r|Q.'....H.........<^)|........Z..........p..:.P>.]..z..3......\....#F....Oa.C5H,.........Y..}.z...$.>uT..C.+....y......"....K.YY.....T..\Z"](.yQr...dw......^u.\...a.!{I.!...b..L(.')<.XB?.(.M..M.......d.......a.i.i.%..{...H_s1h.yj;}......~.%...}..4`..*..]L3....*.L.h.IC..Zi..v.N.4*#..T|.....`K%..."B.9.Z6.P..Eq.R..E..r...'.tk.X}.RA._.=..5._3mc..y V..3..../.:.[....(R.K..&8.s.. ..}4..zd.hz.../<.J..Ps2.....O*.c..

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\wctF411.tmp.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):74429
                                                                                                                                                              Entropy (8bit):7.997265072904654
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:1536:oVKqvnliYOT6mL6i0pgMV+VFZlKJX2t7I2GlUg0pcZ7qKtMhkf:oVB/oYcL6i0pgMAZlKJX2t7v8ZqKtMWf
                                                                                                                                                              MD5:75B67F02FC408598CD01EFE6FAFCE549
                                                                                                                                                              SHA1:37479AF444F9628509C7204715AEBD4757B631A2
                                                                                                                                                              SHA-256:E9AE9FF5F83C117BEFFD3B08BA39B9FCF118681F0A454E621329478A7170EFC3
                                                                                                                                                              SHA-512:E262B11E7D01ECC566069C17F83870FAB1B8C99CC0CC8C2E866745DF9E97F546746398B76EEFFA63B016538F586D9188AFCD542241C64E0CEB6E8BA7E01DB244
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:C.m.+.ys.....3x....}O. .^.^#.]<.O..qs.............. .$r8......."(..$.f.}.n..!.:....^S....% .]....;../.Y.1...\..w...S>=Xt.{......^d...@_..j....?...g..e.kk..B.....(_...8f\.X.d.qV.y&EZsrPd....x..H54..8`:..\...FV...!...v.+.T.....(r6g.$.c.r!..S....^[.l..............|.e..?-...3...k.+E...c..v...A].....r&.Z~.e..:..d?).%m....@.h.)Cl...#..F.....P.....P.o..6a.o.......*.NI...".s3.w....?..."..`1..:K....y.b$...^.'gA.=VLWV....{.._.. KF.....'43G....A.!.c.X..}A.k......`.. .O....M..0......K0.......}.+[.44.d..1Hwz.A.^.!_4.x...v......Lv.!Z..e...g....eW.f..|...VSOi.....>...sdH..K}..4.P.H2.......5....4..E.Mi,..Od.......k.l.@IWD.qH..._..>...Ex~@z........@x...n......%.T.m.......0.B.l.~..s4..K....9.'U..C.up..l.B.qUGN.:.R.[gZ,..^7...v.....j8Cl...kq...d..]..n..^..M.....5K(..@.*.1T.qA1}.!..'.*t..s.........c....|[i.~^MN...Yt..h.....Df......U/!*......(..[.....i.Dl..9...AK..?.....u.J......>Wr0..c+.........].u.C.##.2.M..wi#...6..V.....G!..).eW4.......c3..SI\M...z

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\wctF86A.tmp.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):42164840
                                                                                                                                                              Entropy (8bit):7.951935462206582
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:786432:RdQNeYDx1MPJy7LT4NDnidrZy9xtg5gGOdjhSNu4GnluUNj56IpK:RdQcWx1MPHN7idk65gGUjwu4YNjLw
                                                                                                                                                              MD5:E7BDB3D33F8D08B3EC56A98CDCB50469
                                                                                                                                                              SHA1:6E9644F06B04D7794C4E38B48FDC910223BC567D
                                                                                                                                                              SHA-256:828AACC9E110E98B58B8CDDFF6747AA817F0CC1330DC2A76CF7C8F19A9AADD3B
                                                                                                                                                              SHA-512:0EC0CE8EB3D9D7A897B571872A7F7003445E3AFB0325448C25870731D6817595BC7B00432BCB5A4A701EA265AF381D5C9BF5B25FEF07D8BD2EB687C6841B8EA2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:...._:.}..............N.F...3......$....."d..f'.6...+.......]..i`.q*...+{...u.?.Sf..X|............{.7t.-...N6....'.D'.e.`.......$Z....y*....cy...'[.'[.}../.O...qM.4o.D.|*.2..@'?-..>...._...2.fH..#.+..S........v,....`!..X....9?..&.L[<.*.b+..}.|..K^W.VH.G[.......:`.^..q.r.f0.p.T.].(...b}....e...gN.......%M.....b.D.........E.....B.w...8Ai.H....Re..}.......h.J.;..#e..Q..A|....c.~....M(t.=.,..R.NW6Smi...m|7.?.SC.t+...M....n.......d.DT..,..B.......52le..E.U..Rw..pf.B1..,S.....`...;..;.7....@.;...*.{.c...Hb..p..f2..(..e..kgT72......(.?.2..3X.$......u.A.....^.y4..........X8...G..z.]."....\...+z|........t....".........z..t.6..?...Y.m..S...".(..X..\y...uI..B..@.@.S.cS].i..R9.X.*....A(.9n0c.."....6.v......T..6./Bq.J.Z+K...f..m...`Nz.o.{s..?...T[{.wu5..S....UY#|_..baXB._.n..d...hE...hX..0..].......E..R..d.Y.-.0..H..5....N...B..b.....8.X...........&..N....3..|Cj[..e}....5.?...z.m.Qf/s*.....=.-~.1.YB.9..+.>.Z..M....)...9..4...X........X,

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\wmsetup.log.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:SysEx File -
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):938
                                                                                                                                                              Entropy (8bit):7.781225932478449
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:EBASZ/StiSS5J8xTpgRj9azAFrB1EogypAVF1pCSuc+:EB7lm1Mj9aGf3Gtuc+
                                                                                                                                                              MD5:50E5E0A03FA39605FF86779E2F299222
                                                                                                                                                              SHA1:EED643FA5E15CC2E9FAB0E17C7775A5DFD6CF64B
                                                                                                                                                              SHA-256:2269C7CA2F91872ABB18FF09058230C973678985893B97C148CFAEA955D0F6F4
                                                                                                                                                              SHA-512:040951782E8B991018B743A9CA1CE4795B7B972A52295661B93409A0A22DDF6FB8EFCF79D0D7D82D0B6EE73243F0106873ADCF6850267EA83D64AC061250A853
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.n...h$..".#...V.8i..=m......0.9..A...A.;p..r.P...^C..TP~*.&:Q}..:..z2..<.4J.">..~^O. ....j._.]Ub.7.p....]..WTM..@.....n..S..8.T......&O...:@.".n<._!.)F...l.Z...^.)..%.Jm.Z..)v....o..:;.X.S...`..;x.t..6e..l..,.7.!..0H8..1../.)q....n.:r.....G...:C\.7(V......Z....V.5[~Y.c...!..>~Q..^G.qq0....@..+.E7....q....<....k5...x{........F......O.E.*...........J....3..+.F.S3W..R).o-......N...i.4.m.Xq..A..w......,}/....?k(I..&..b:...y\.....b~HCPb.A5.5;4z{$.|..=h....)VP.......m."}...*.Ea....#..L.D.J..I...?..xt........e..KD...1;...K.PY.D.qo.....M.."..W...$.J......s......W),.....*..nb.B@oF......u.:..``:.....l-.H..y.+.N.sx...4r...\~..l................^k.O.A4..\.]..b.l...\.~3.=9..7........`......zt..E .$.t..i..xtOV;2..y8Qi....E.^+1.E.....{.>|.#.uT._...@..|.n@x....Z.O4-{.SH7k..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{00A6A023-AE0A-45F6-B989-71FCADC6D344}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 69x630, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):11040
                                                                                                                                                              Entropy (8bit):7.929583162638891
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:u99+91V42ho91V42ho91V42ho91V4235z9pUkDCyixxo4PS6b8tEy3BcWWhhSy0b:ubKD4/D4/D4/D4uzX38u4PNYJ2zhhmb
                                                                                                                                                              MD5:02775A1E41CF53AC771D820003903913
                                                                                                                                                              SHA1:2951A94A05ECF65E86D44C3C663B9B44BAD2BC9D
                                                                                                                                                              SHA-256:83245F217DEAE4A4143B565E13C045DBB32A9063E8C6B2E43BB15CD76C5F9219
                                                                                                                                                              SHA-512:5A1FCC24BDD5EE16BC2C9BACF45BCECF35ED895EAC22D2C4EE99C1B7E79C8E8B9E5186E3D026BA08FF70E08113F0A88FBF5E61C57AF4F3EA9BA80CE9F33410E9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....C....................................................................C.......................................................................v.E.............................................S..........................Aa..!12Qqw.....3568rv........".....4Btu.....#Rs.(W..bg.................................D.....................1..2.!4Aqrs....Qa......t..."3BRb....#.$S.Cc..............?...K/h._+.N6.-.a...5...;.r....,...0B.s(..zp..4.%r|q..E.Q^.../...C.R..?u.q8XN.>.e..:..gJ...._.n>.70G,..(........3b.&.5m...Q../...7Ie..k....e.l6..&..`Gt.P.Y^r...=..Y.e...N.B...O.#..J+........u.V;G.'.....V.]8..C.]..........E.....c..w&lX..f..\T.J?...F.,..m|..93........,.....+.R..WG...%.....(@.....p].iEz<.8.^...J.h.....a8P.1......(z..y~.........H.Z^.>..<.....L.k..IG...R.(.%..m....&u...B|.....@]ey.W.J...!d..R.8...[..>8....(.G......!.)X.....,'..F2.Z.t..Aw./..Z..#..i.kK.......b.i...qR.(....RE.............O.XP.#..(...9J..]...,.2.[w....KrW'...tY.......{~.:.+..

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{02662522-698F-45B5-959E-0EC7B36298AD}.png.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):6076
                                                                                                                                                              Entropy (8bit):7.974055339817883
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:iy3fhUXe0qklkLjDyjVm1OVxL4NVRlVDwpWy3fmzbDusvoL8EBNWfM+:p346ix6UCNVRlVspW4yisQLPJ+
                                                                                                                                                              MD5:7158EE0213A9EE23C20A117ED629BBC0
                                                                                                                                                              SHA1:B2B72449D321F0B789965C3CA1D14150D567E532
                                                                                                                                                              SHA-256:A03C72673681EE8D90862FB098CF161C0BC15F1FC8889CFBAD902D6D70844268
                                                                                                                                                              SHA-512:40CB7673CC87F7E4CD41F6BFDE30C0FF67D541DAE78B780C70DFE1F64108047F7425AC164BCC6794AE8459A6840453EA03BC82221F796358C6F317ACA284DFB6
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:P.U..k&.p,[.7.HC6(!....Xf..P...-.....p..... .45....4...cgM......XIv..i..J.s..8...7:..}r..y..A....p-.4....Y............sx...)7....d...u....N...\4''...q...)a.f....]...}...O...@b...{..W.F._..,.Z0.t....C.2.Q.4-/S.:P..\..[.6......m.b....n.U.(..c...TS....67..".#..ak.Zx.w.,IyV.Vgs.I.Sp....o..2"...*..R..I\aS.P..k..:../..a.t..SR.+=Q.!..o..pX.kqRJ..'.JQ(S..!..O.4]$.FO.....=.b.........3..}t.rv6..._.....DJ...!E..osl..$....W...v}.R...+.xO<..H.D,.l...........V..g......n05.4.....k.`.I1H#._.b........^.l....>.....gc#z]c......c2.L.....q.u....rm..&4..BA&.H...n...S..W.....*.......Y.LT.i....u..,,....).....4Zk..{y....0l..A.p.?P\dMR..WzP.._..b}=_.N.c;.C..9$..*..$q.&...|.o@...7....M..ha%...{...,.......d..`...HA....L...C.Q.G.yp....[yX.)....t...n......tq.$!R".a...?^h.*........Co.t{D.W.)....f..!..!....A.Mw.E..W..*.r.......d.y1..f.V..1n...~...+N!...%i..@.._...vl..U.Qk...A.Jo.=...}...F.[{..}"7.,.Hr...D.....>.....b.cP.<.5..V=.y3......]....z=.7..e.G.+.._.a

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{0931CB5D-13B9-4D1D-AB7D-9A0199F83695}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 76x97, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):784
                                                                                                                                                              Entropy (8bit):6.962539208465222
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:869YM8fij0W/xfuCp7ovv1bidiMn3bGi6AETQcdH8SADjoZgV6v9jUEvS3/g:N9YMWeI424diMn3yinsQeHvADu9QEvJ
                                                                                                                                                              MD5:14105A831FE32590E52C2E2E41879624
                                                                                                                                                              SHA1:078FA63FC7DB5830E9059DF02D56882240429D90
                                                                                                                                                              SHA-256:D0A3A1C3CD63C4023FE5716CBE2C211307D0E277E444D9EF76C7FC097A845FD4
                                                                                                                                                              SHA-512:8FC0ED24E8EC14C46EA523D9265DE28F85C5FC57AA54AD5B9CA162E95F79221E2AD3DD67D1293CF756B67F3D3DECAE122254134EA8D4D00DDED02114B5383947
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......a.L..".......................................-........................!A."1.Qbq....2Ba.........................................................1............?.....3.Ty\......vs....>.>..a.W..s89.d...Z}......rz...`...Z.r.do....u.W.%....gf.>.L..xz....B8=w...g.~g."HD...$..IKJ......nn..*ly..I....L...\q...Q;6.KrxZ.,...j$..ZQ..)f...q`.*..C1..cZ2]-..\.~..J.....^..(.f..9m?..C.NI.UL..X.fy.Z.........+n....r."Z...d..R./\.#...kd.D.5.!...h.3*s-+.......Xjt..}i..rK..y.../>u..]N.....Y..J......1.x./.....F6.......I...._3...k.sM.+..v;.%|.f.~.......:y....S....UKovh...W'........lF... .................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{099B3DB0-0330-472B-A40E-A39EEBC2E841}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):52945
                                                                                                                                                              Entropy (8bit):7.6490972666456765
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:cjvqR0XvFaGCTJffi0tgybmWDoTw71kHUAnjvawrlp2+NUO8dWSNl3PF2PjK/q09:cyRffflgybmWoTw1UUADHUbU21MjpAD
                                                                                                                                                              MD5:AD003F032F32FAC4672D4CE237FA5C5B
                                                                                                                                                              SHA1:AE234931B452F0D649D91291763B919CF350EA49
                                                                                                                                                              SHA-256:ADB1EBBE18D6CD8FF08AA9BF5C83CDB83BF9AA179698E34E93DBCDDE12F04D32
                                                                                                                                                              SHA-512:ECA25FA657ECE3A66D3E650628E0F65D3BADD38864C028AB6553950A1A66D7D55482C85E9E565573E9E5AAFA91C2D53235971C644A266D41EB69F8E72E3A843B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQ..aq....".....2....BR#r.b3$...C.Sc%...s5E......................!1.A..Q.aq"...2...#...B...Rb3..$..CSr...6............?......y_N.e.H7?........W..w....k|...S..d.4.>.RW5z.$.i.)V.O....>o...c..*&1.D..O..".ufbb..1...t..u=..K...m...~.....F..-.fb:i..=f..C.w.[{..~.7k....;..:..3....4.....$..m]...}....~q...9T.#..7.~..8...q.N;c..ffo.w...W..d........../t_........lWJE..).>..v;:=....Rrw#.m.n.n...E...vm.J}2N*..|.4...80.#..e....t.J..ZQ.x|g/....F..e....k+vK...M..W.X.e.L..~...j.....kz....=...n:O.:..[.L,.+R...Y..zKNI....,..{e..U.'...}.......|..t.]...~...b4......_.i..../.......m...a..n...v.j.?..Rc.$G|.31..#..$?.........h.w....-... .a.%z..u......u.A....Fm..J.......G..[...w.....:....w/.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{09B5C1DD-6A40-429B-9FCF-7C579BD6D018}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):53259
                                                                                                                                                              Entropy (8bit):7.651662052139301
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:dCiCBBenRYWDBCipMYGTbYGLHbXxoP/qEF+MU50qyJ30h2W474S/Aq/xc4674bi5:dCiIQXBCiwbDLHD0/sFyVel4Pi4UgE
                                                                                                                                                              MD5:2EE369ABB7936F8C28FF0ABDD224EA05
                                                                                                                                                              SHA1:FE9D304A7B49E31EAE439369ABC548E265149636
                                                                                                                                                              SHA-256:FB12D59B8BE911247BBAFDD416852E8B74B028005A141CB4DBBBA109B4B6ED2C
                                                                                                                                                              SHA-512:5CF396CA472C32AE988600176114106CB1619404DD899A3867A5AB43DC90583B771EF69B14EF50E56A21F038BF51D8463C6ADD2DE9D4CB523F6290E24A4DECB3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..AQa....q........"2..R..Bbr..#S....3$.....C.4v..(X.DtEUV.....cs..Td.5uf'Wgw8Hh........................!1Q.Aa....q.2...."R...r..3.t..U...B#S.4ub..C$d.5Ee&'7c.D%sT..............?.....?...k,lk^...M".Yo5.Qp.&s}b.m.:...W.x}.*.a......N1..d-n.-..^..b..TZ.W..."....F....^......ve5...^...2.:i...........~u2pK.z./&..u..L[I....Y....@y{|>..MN=:....Q[..H....a........|%..4fV....).....^.9b.f...F...p.=.W...aZ.........Z.t.n.....z3..[..lVh..\.N-.._.sK.y.._e.G.jig.a.7^....u...*.p.5.a.].........u/u..D.yl.XA..f.z..~.x.....N.....b=.uv.2.t.'.N.-.H..n.v.a.A[.Z.....T2...._...:....h..l.E..sm..a.3I...RE...fWb.Ek.0.#.)..Y#T...........u{....U....s.].7_H.2.`O6...P......}..4LR....]4.mid...

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{0A5913D9-D5B4-4040-AC64-A957C30F5977}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 780x107, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2898
                                                                                                                                                              Entropy (8bit):7.551512280854713
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:N9YMTXc4gpw+EIWnqQ5G+NE9VTzRFvS4+Xh+AKrNx+JuCluc3Eeky8etajhDCFex:/hDc4rPIoNEzbS4+XhOrGJu1cUHeoVey
                                                                                                                                                              MD5:7C7D9922101488124D2E4666709198AC
                                                                                                                                                              SHA1:00CC44A1B84D4D94A0ACE8834491EB5F65D04619
                                                                                                                                                              SHA-256:20016E5FA1A32DCE5AF4E92872597E36432185A7BB2E61C91F362BD68484529B
                                                                                                                                                              SHA-512:882944B2CF040485899128E03B7499C540D481E45FE8017DBF4FE0330157B2D8ABB7334DDB31C112BA0EFE3722A554883917C54155A7F60044D2D7F3D848260F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......k....".......................................2...........................c.....TUb...Sa...QRqr..............................!.....................Q...R..!..............?...$.)m.1...%%bV.J..H....-.%a[...I"WJ..:.X.:TT.$.......N.-NR.E..-NR.E...9..E....$.k.....B.I,I)..J...kr..+)..I,Yj..YbI..+,J..e..Z..V.e.$V..TV.X..V.YQZ.EQ..U%PY[.[.R.EP............................| F.. ...j*...!m.!j.I%.j.$...YeEYYEEUE..eY[.hEEUeEil.....%..el...V..TUYA.U.UTTUT.Z..UQQUQE...V.,...UlE.U[.lEP.P.@......................................R1...AR1m.....#..$:.T.p..IJ.t.....A..AH.,5..]F!a.XJFaa. ..a.!*.aa. X.e.......bB.b..,HX[,!..,,.c0.,..U..X..(,,...B(.,..4..B.`..".a..-......"...........................>D..IKEb...t.....)u.....)K.%+L\.J]i)*b.JR.IIL\i)u....T............T.....qs.it.iJ...])ZJb.....X....U.A...V1..B.R1....X...,.c...,%X...,%#0...,H

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{0CF66A2D-8977-46B8-96AD-5BC0D4021351}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):84941
                                                                                                                                                              Entropy (8bit):7.966881945560921
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:X3sWfhTVd+xu6rA6SOONM0/YFXnviDwoPCaNSm+z/ze/fWNj7GfigeKyCGzw+QKW:nsOhdDJOwY1voPCaom+z/zeHAfGihCG8
                                                                                                                                                              MD5:CB84C108A76C2AFFCAC2551A3C1EAD56
                                                                                                                                                              SHA1:8BB7C2A12B056C1ED12EBBAE5BC9F60CCE880FFE
                                                                                                                                                              SHA-256:139BB0E79F89C3DDEF79B1716A5FBAB4C07DF5785FB3CDF6B4EEDDBF6C078452
                                                                                                                                                              SHA-512:6EF85144E9A7ACD0FF2E52A5FF42093153EFB69127B1C8549EEBC49B6CC196A46B65EE39A2CAD0206F6A41476D8B5B35D29EAC9942B8F84972B32E14CAFEED27
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d....................................................................................!.1A.Qa..q...........".2..BRbr#.T.3C....S$.cs.D..4%5......................!1A..Qaq."2..BR....3...b#.r.C4.............?.......m.q..'O.....r......_.1....8h....?.....O]~..k......GO...''._...!....o........''..g..H?k.......1...?.....z......>...+0..................GO...''._.........}.O.Z|.L?...........?.........[~t.......}......NO.....v.......J.......?..g..H?k......GO,m..r}o.z.....}......dC.9?..g..H_..........?.....O]~...m...C?.z..f....W.=u.B..m..C.-?.a.....3._.?.......o....np.M....g..H_............9?..g..H...../..kO...''._...!~...o.....0.M....g..H.........../......O]~.~...o.......7..+.... ..l?.}........&....3._./....?.........W.=u.C..m..C.+?..o.W.=u.A.^.O....:......_.........}..t

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{1158CFFC-D5A7-44F8-AC58-E0F12DBDA9E1}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 50 x 600, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4410
                                                                                                                                                              Entropy (8bit):7.857636973514526
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:E/pQuIhKZ7u06dICH3AroiTe8DGTl55poBUmLNjpH7MvDHjfm:MpdZtPbknnRPpkLNVMvu
                                                                                                                                                              MD5:2494381A1ACDC83843B912CFCDE5643B
                                                                                                                                                              SHA1:98F9D1CC140076D1AE5A9EA19F47658FD5DF0D66
                                                                                                                                                              SHA-256:5EEBE803E434A845D19BC600DF3C75E98BB69BD0DE473CEEC410D1B3A9154E28
                                                                                                                                                              SHA-512:0E64CC3723DC41D94910F7ADFB6A0DFB5049350FD15A873695614E4A89ABD78B166BA4E9C8CB95E275FB56981539DECD2A7F28FBC25E80DD5E2DEA8077CC9489
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...2...X.......E.....PLTE...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................B..(....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.].\TU.?3"...(..L........q.Q...H.*j......W..Xd.ie.f..%.XT...em..m.m.vkik...>.}..}|..{'.U..~......}....s.............,CVu.x.:C..5...;.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{13149A0C-11FC-466C-B4A7-ECBE9A5527E7}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):95763
                                                                                                                                                              Entropy (8bit):7.931689087616878
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:EoES7mhTyzabUaE77xAOmq0zVruQlttNxlipxVWssMU2YhRy2v6pKKYhQzwMc2:zz7mhTyzabUa4b4xuQlttnlGx8x9h02M
                                                                                                                                                              MD5:177DD42CA99CAA2CCBF2974221680334
                                                                                                                                                              SHA1:35FD86B3DD082A6D4930C67BC0E05D3B5817465A
                                                                                                                                                              SHA-256:525A857D0EDA855A64D3619DF58B1C2D013A73E60FA0D49B155ECFCB2C134C7C
                                                                                                                                                              SHA-512:6FB6D9A6C97B1115C3246690A2F339CD612899AC25ACBA00296EAEAA0A1D094E7339D670969764FE23EB7C08FCDD01C6F78FBC0735D504D5E02AD342901719B3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!..1AQa...q......."...2..B#Rb3..r$...6..C4....Ss%5...tu.c..Dd.EU7....................!.1.AQ..aq......"r..2...4Rb#3$B.Ss............?..H..dV....U..-..0]Cp.%O.Z.Y.e.=/.q.....j76.w@s...5.&&&5...n..w..>.1....;.vR..[.......=.......KtY]u3.g18...).r....&.IZ'.....g..4kY..X..b.......y<...r1........e.._...X...w....op.m%Jr31...S.Vo.._....OI\]....F..V-....\...2j..X.....y.p.$4.....&#..]..n.V..x..P...F..C.f....])..~..Z\.....,..#..v..v...2V.k.SuaydO../[.*c._..oTV<Z.s.[...o.x..>....-....v...#....-.X..L.Z./#.XG.-.0......%w..H.@aZ....C.}...N~.;..R......5.D......I.... .R........s.>..ks....(...S...9....2=. :^.. p.+?(....$..Q..I.........=|..`2. v..t......U*.8.u.. ...'...*...2;u....& 3..$.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{139BFC28-947F-45CC-9DE4-AB0FCAEF6E9F}.png.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):6077
                                                                                                                                                              Entropy (8bit):7.973385615965076
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:bDJ9sim19FfbCzBj24zNWLgmTmMFfmYfyIe7d48F46Pwr9ANwZK0VtqmpTbrh4oh:bsiuFfK842gTMFfHfbe7Z4mIWgVfBpTr
                                                                                                                                                              MD5:45BD1C8293143D319F14222E2F9B3B1B
                                                                                                                                                              SHA1:9C4A882C83178586FA3B67DA71DC0267BAD46824
                                                                                                                                                              SHA-256:2EF86DB4197A4481FE4CFA4AD36AB7F9ABC3203B2A9D28B2CD4FD2E0992182F8
                                                                                                                                                              SHA-512:CD28B51FBA72DFF98805CF5FB001DBA7F907311FB384F4F798A7BA7FD942E5C9171FB1112870A3AA8451E8E8EABF475FD13CEB4ACB543719B28E9FB0A467F68F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....1..'G^...Y_..l....W.....l...<.6...W...*.Jj.#.-.+...p........T..`.|.1..6....m.....4..j.~!~Hp.j.b5)..U.>g...'....m.O..8....g*[.9q..q29...k....A.ka......0.(.z|.[...g=.al....mx%.N........T.[.....2.$s+i.?..0..f....&......yoM/...`A.........SB.].7... 9....K.+i..(4.....|m.<b..|!..7.t.66Iw.......O>7v..8.I..........9.}r.9...J.^.1>x.n'.......,._.<w..........e$R.p...>..A...v<8....\.p..5...'..[......t.,Y....uf6.Qr..n/(..)^..o..nY.z......(?O ._.......]]...6.r!...'1.h.@=.`..b|.3.%a...*"}+........S.;.3'}_.^..v.N`./$|...4..`.[...K..#.....P......S...*U.."Zz.~.........(...ik...I..o....q#;#.....$.......Wlt..:/?K....:o.}..n....sK^.57.@H.M.q.#..-...i....+./.B....'..m.<..(..255j.4....C..]......T.B..tV.,P.........J.K.?..g..P6.D5.-.....F........Q.._k...f..;...........[.".+J. .Y.4.T.....\......=\/....!.."w..>.Z.<.R.+....].M.<5vJ.`h3.x....a.1....<!e......C.i.%o.....p...6.....T.V..8-E.9...W..uXF;.BU..q1#.....T*..q..}rQ.f...D... ..<...`.`D.s....t..S.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{18812DD1-8234-4D01-962A-108668E754A8}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):40884
                                                                                                                                                              Entropy (8bit):7.545929039957292
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:MCBOA4d+ElOXJ/3pI7cRBiL7L6qERqGz65WXzZqJsKQSbIsTT6XB:hIAU+2cGdLX6qBG4WDZl4Ihx
                                                                                                                                                              MD5:7379775A1E2AB7FAB95CFFCE01AE05F3
                                                                                                                                                              SHA1:3D3DDFD8AC7E07203561BAE423D66F0806833AB3
                                                                                                                                                              SHA-256:9301DB6D2D87282FCEE450189AEACE16D85F64273BF62713A3044992B6B7A9E9
                                                                                                                                                              SHA-512:4B5006E620E80D3A146944649CF4CA619782CAD7E8C4CD0D1DE0EBCA0FA05EACB7378DAFCEED3E26F5698B07F19604614D906C8F51F898660E2F129D8DEC6F62
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1A.....Qaq....".....2....BR#S..br...3T...C$.7(Hx....4D.G..Xh.cs..'..t...%...8.....................1...!AQ..a...q"2.4Tt.......R3S....Br...#s...Uu.bc.de..$D..6..C%E..............?...z...;sB.yv...........]t.\...n...../....m....M.=.3G+..x+.....S).*&.J../..8..O/+..sG...p...<!....~.c..C.w..,[oHom.wc-.J.~.......L[..6...'..i_..S;...!Y.z.q].EK..M.x...i.x.+.;.+...}....#......f.)........e6V..p.;........s.)..Ml.J......IU.6...<9+9.^..l..Y...[._...2..^..j.ia...._..3.;...~..<3...;......z.^.......]..Qk.,...Yk...3.3Jy^p.}....q...I...&..t.......;..9.g.GH;..'...%...)..[..y..../...zCn..>...'...1e.Y..;....]..7...N>t..m-.j.............H^..T\.q.ru...}...eTn]I'r.^].#..wOY....v

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{1884425D-A99B-43AF-AC13-B6A0E78945AB}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 700x114, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2266
                                                                                                                                                              Entropy (8bit):5.563021222358941
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:TuRCTP9rSTfIEe1HbcVY1YbDXq8eCI0bf2QQe0GVDQAzZw:aRCTN7HbcW1YbDXq+I07Ien0AVw
                                                                                                                                                              MD5:DB8A181E3F0EAD4A9472099E42ED6BE3
                                                                                                                                                              SHA1:92096AF05CC6167B1AA816811A1160B809393FA2
                                                                                                                                                              SHA-256:E9746B4E9AE9CE7B3B0068779DB3E113E2DFC9880F25373D745D0E700E69A906
                                                                                                                                                              SHA-512:A9E246E10E28D057090BA9F034ECE6131780D7F794C5C9421523388997C7EDFBB49BC32B863B6C6668911B359C304AA54969B48CB9234950D5CECD2A6F3EFFF8
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....C....................................... ! ..''**''555556666666666...C......................&.....&,$ $,(+&&&+(//,,//666666666666666......r...........................................5.......................!1AQ..2a...."Rq..#3BSr..C..................................................................?...X.....U...j...F.W.V]'KV.uWt.iT...{.......`.(.....V%..=.....z......V..ct+.U.B...@.............................................{.....5.........0...x4....c..;...........+......|.7E.%.9.1+}..d.........+.V#.P.HUL.E...g.li...8.>U.";0pi.]5.\..zo..."@.........................................y.6.mLN..S.....@...i..A..p.......~|V9.+.Xy.........+,L.....7Z7..p...-X...\.....:-...i....v.1...-..H....9.zk....l....^.......:.."^.t.Q.F...X..B..$............................................a.%f&3..1.5+.X..'b7bwr.).e.x....!...H...aa_..kD...b..g..p..K^.k..qX.[,.........Q...U..x...YMvj...w..:k.....j.W.8..4....c.u.}m.....o.=@.......j.S.t.|.....5h.y.%.~...G

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{1ECB4207-50C1-44AE-993F-676F40933ADA}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):136726
                                                                                                                                                              Entropy (8bit):7.973487854173386
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:SIXmy5Tl704vW2ZKkvV8UU0ZWUF0BJwySIdgz816YzDc1+opecYPn:Sny5Tl704fZFV8UU6LGXwyS4xohpQPn
                                                                                                                                                              MD5:4A2472AC2A9434E35701362D1C56EDDF
                                                                                                                                                              SHA1:16FA2EA2D2808D75445896E03B67A93000EEDDD8
                                                                                                                                                              SHA-256:505F731CB7707EFAB2EB06685B392DC7E59265A40B55AAE43E5DC15C0A86CBA4
                                                                                                                                                              SHA-512:5E28D8FB2AC62ED270968072A30013334461F7CAE96058AF9EAA6E10912989DC47112D2133892BF61F7A516B77C6FF71BA2A000B750A9F95C787E538B09595C2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQaq".....2B....R#..b3...r...C$...X.....Sc...9.%'.(Hs4Dgw..T..5GW.x.)......................!.1..AQa"2.q.......B..#c........b6.Rr.3s$.&..S...C4.%5............?.........(......(......(......(......(......(......(......(.G/.GE&...)..P.x..B.({i2Y;.z?G...Yfc.)H..^....#.....}3..Sc^.H..+...M.a.P.....GS.....H_.3..<....1f........1.<.\..nn-..s.s.\9Y....=.......S.0.......N..cA..Io..r.3..........ay.....K.....,.;9..Q......xO.Fa.2..>........{4k.....|....?U....3.8..._/3....#.. t.y......yY.......e.<........#.....B.....Z.%.Y..S.ye.W4...l.......X...%.@y}>....l.yi..D..W......L..._D.Q....)...E....n.%...*..K.4#.8`..I....h..h.o..I......-...hB...3..u.(5..........n...,.@....a.t.9.....@.s.>.&...@

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{2836A0B1-6795-4094-A797-E4D7C2AC1B11}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:05:55], progressive, precision 8, 612x618, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):68633
                                                                                                                                                              Entropy (8bit):7.709776384921022
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:tapXpSTJDOkFGdJdBk/slsbfsw1imaapnbvD8:U2OjJr6b07m1bvD8
                                                                                                                                                              MD5:41241EE59AB7BC9EB34784E3BCE31CB4
                                                                                                                                                              SHA1:98680761A51E9199CF3C89F68B5309FBEC7EE3CB
                                                                                                                                                              SHA-256:035B26DF61855A3F36DBD30FDAB0C157C04C9E8AE2197EA4D4AEB3E82E6A4C2B
                                                                                                                                                              SHA-512:3EE331D5BCEE4AD5D3FC9661D4AB4053F7D351591A094334F963C33C9D0E32CCCABE9334AD7C308108CE99617E064FE848DCD469ACD8D83FBE5C4452DE523D8F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:05:55.............................d...........j...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?../$.W:SZ./...9.....-...u......r.....].c...@W_.7...+......v.+PD.I..-<1.pDn-\.....p.$....0.}V....\..>.~..XN.o..l(E....ik..o.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{285BC3EB-1848-48AE-966D-9B11CDD455FE}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):15740
                                                                                                                                                              Entropy (8bit):6.0674556182683945
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:Elv3GG8/OOs+GouFdxMlxjoPyerzkpuOo2vPMc62PaJseZC+BJoS/:EtNiwdxMlZoPhzkpuOo2PMc6rX8+B6+
                                                                                                                                                              MD5:FFA5EC40DC9A0FD10EB9E6355142D6A6
                                                                                                                                                              SHA1:3D3D6A7E086B3C610C08F1F3E3F883604F06F2A4
                                                                                                                                                              SHA-256:D74C3973C8D1F7C77274691AFB1AA934940674341D7EEE563BE75E563281BDFD
                                                                                                                                                              SHA-512:6FAF2A24D06E6008F3579C7CEC90C2887462BDF83FAD7372FBB74B8DE90340B580E9836F309B68A9794597A598F7DCDA661C9A58DA6D8187C69083B7A17C9CD9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!.1.....AQ..aq.g..8...."r....2.FG..#.E..7.Rb..Cc..D.v.B..3s..$d.%5Uu..&6fW'w........................!....1Aa...d..5e.6.q...Q..."2b.c..r3DE..BRs4U.#C.S.T............?...u.&0...cV.T.I...1..=4....Ce_.g.q.=F.M:>)...k..pm..h..=........S....)Ja8x...b.).=5.q..0......k.M.....1?-.G.b&.5..Ep.8t...'...R)..ta.F$bXO]tW.b.6#.t.XWN..ZW......].....G....x&&f..'L.....7...\...'.8...~`.sa...............................................X........qo...SMk...'.V...i..hb.}&?/.k.:>l.^....>Y...<}...&.jY.Gn.MKejyV......D......gf.0....t.nw..XQ...H.B.....=8.UkR.....Hm..w..]...k...#Z...F../.gjWvf.....w.aZ].2..5..^...VZv..._.7..a.|...:.B...,f...............~....m.;_.....-.e.y.w.[m.].bu.b.f+.E++\.....Y..7

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{28F275CF-3650-4C72-9BA2-83AEAC9F0F31}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):32656
                                                                                                                                                              Entropy (8bit):3.9517299510231485
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                                                                                                                                                              MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                                                                                                                                                              SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                                                                                                                                                              SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                                                                                                                                                              SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{2AC5B4E0-96D5-4F40-A93A-CA29AA477F06}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):60924
                                                                                                                                                              Entropy (8bit):7.758472758205366
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:kU7O7+CFqO6DkxTgPzo2wqggrrX8QvN1I/ZLBttB9+dPFXbc:hVuqJDaTqo2wq1L84N1I/Z1tT9X
                                                                                                                                                              MD5:D58C51D2CF586A5E14A9EC8529C3B0A8
                                                                                                                                                              SHA1:F4811A353797C29B1E3F5A61B125C46E1534D587
                                                                                                                                                              SHA-256:F927C7825851974A2149868146970706523A49165133CEE6027A43E8C9ABDF27
                                                                                                                                                              SHA-512:34B963173AFBDF07432F4B983D29F10376E4771FE666E9D50B1A81DA0B9F6001FD86B4A08B9711386DE153BF6E03C8E932E2D181C8EAF94EFF34D20FCA7570E0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d................................................................................................!1AQ.aq....".....2B...Rbr#.s.4...3$.5u.6v..CSc...DT..f..t..&F........................!1..A.Qaq....."2....B.s....Rbr..#4...35...CSc.$...DTdt..%..............?....O<......X.O.Fg..{.W&u.u.T~.|r;g!.._X..N.p.4.........................................................yK..xd...6..|%....\j..e.=...Y..f..I.|-....e...$R.j.......~.W#....{.....V.k.|F..z^..:.~..f......"x.....L..K..r../.;..[..l...;.U...W...X.........8.....y?..B...m.......j..Q.g3..G.K....GL.o..n7a..Y..[.'.........x........\......~...f...0\Wc.n?k.|.....1.ww;..2..?...r4uF.MXdB6..W..mG2NJ.E........u...2.q...Z..=(l)jU.X...U.\X.......O<......X.O.Fg..{.W&u.u.T~.|r;g!.._X..N.p.4.......................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{2AEE4650-76AA-440E-894D-0979596F4887}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:09:29], progressive, precision 8, 609x675, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):65998
                                                                                                                                                              Entropy (8bit):7.671031449942883
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:klZtmExaFrtWgpc+Sg+DKeplHClpHfRtPMbe:VEWWl+SNDKqlH8p/vse
                                                                                                                                                              MD5:B4F0A040890EE6F61EF8D9E094893C9C
                                                                                                                                                              SHA1:303BCBA1D777B03BFD99CC01A48E0BB493C93E04
                                                                                                                                                              SHA-256:1F81DDE3B42F23F0666D92EBF14D62893B31B39D72C07AEE070EAE28C2E6980E
                                                                                                                                                              SHA-512:8F07E4D519F2FD001006BB34F7F8274B9AF9EC55367B88D41D24E5824FCE4354FD1290CE4735E43930829702ED53F41DF02C673904A7091E9354C28E029AD4EF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:09:29.............................a.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..-O..s(...gO..@...[..+....+...H.'m........L.......@.......[k...S..O..p.'{X..3......]W..w.+.V....[.-.....2..i..i$.p.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{2B125444-93EA-471C-A0C5-2A9944BA6966}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):32656
                                                                                                                                                              Entropy (8bit):3.9517299510231485
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                                                                                                                                                              MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                                                                                                                                                              SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                                                                                                                                                              SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                                                                                                                                                              SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{2CB79600-819F-4E5D-B0B1-090D3311850B}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):33032
                                                                                                                                                              Entropy (8bit):2.941351060644542
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:ofmqvnCfmqsp1Ue5xzMq+Qh0dffUmS0w5xzMq+Qh0di:AGAp1rmSl
                                                                                                                                                              MD5:ACF4A9F470281F475EA45E113E9FB009
                                                                                                                                                              SHA1:B20698DDA5E5AFDD86BB359A6578C9860D5DF71F
                                                                                                                                                              SHA-256:5DC2367A80588A7518DB5014122510BF0FD784711015EF83A8718336584F82D0
                                                                                                                                                              SHA-512:998B7DB9DB08FD15A293267E2371052E436E024AF8D34F96D3C8FF04B1316678DFC1674C921CB404121FF381A4FC39DC759E6698F19D42A6261CBD39469B0A08
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....l...........................Ac...... EMF........$...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC........................F...(.......GDIC............^...........F...........EMF+*@..$..........?...........?.........@..X...L........................."B...B...B...................?...........??.....n............;...<..@<...<...<...<...<...=...=.. =..0=..@=..P=..`=..p=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...>...>...>...>...>...>...>...>.. >..$>..(>..,>..0>..4>..8>..<>..@>..D>..H>..L>..P>..T>..X>..\>..`>..d>..h>..l>..p>..t>..x>..|>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...?...?...?...?...?...?

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{2DEF2070-FA8C-4EAF-BBF0-E904B0D2FB72}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 14x341, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3361
                                                                                                                                                              Entropy (8bit):7.619405839796034
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:zDqnxqMt6gGr/Nln5ANln5ANln5ANln5ANln5ANln5ANln5ANllHN6:CxqMQr/rn5Arn5Arn5Arn5Arn5Arn5AN
                                                                                                                                                              MD5:A994063FF2ABEB78917C5382B2F5FA8C
                                                                                                                                                              SHA1:BD5C4D816B04A2B6596DFE38DB01228F553FACCC
                                                                                                                                                              SHA-256:D72900E8DA72D1A7F3729971AA558E1E9B6E9CF9A0D51E83852E567256DBBFEF
                                                                                                                                                              SHA-512:CF2279033DD3EDFE6F6F9E5C517BEBD9A52863EEFD90F57F7A5AE0E0485E705254BE7ED6B50E6CA142669687727AE85E2E6035F69930B75F2E6D3EEFA961EF88
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....C....................................................................C.......................................................................U..........................................>...............................8H........59...$%&7F#'Ddf.....................................>.................................58EG........!#124$%&ACFbcde............?...n.p..v..a.~.._.>......#....8.....w.G...&.W...i...%6m..K;...4."...=..?.~......P..O...j.l..AW.jo..,..=d.h.ta..../.."...z|).J.......Ww._..<Wp.3+8...-5...G:..2.D..I>o..K.F;-.....#...`...6..T...M.....OOgV~..5...np...P..TYr...........b..{r.2.9..].DA.%C....=.v.z......CK."..R..l..y}.i..;.{....JzS.....~.?..Z....=c.h~*..p.@(@..G.....O.]...Hsd.xf".V]..S"..w...4e>....3*U.7..|M.x...|\......FD./.cIe.;.bId..+=...w.......[.k>....}.u...j.xZ.....Q4..+.....B....1O~\......I..h....LaXJ%&.w.<C...n/`.W..U.W.U.}~...}>..^.0.J.....@....LN.b.......5W...m].Eu...:....G..:4.=4ixx..@_0=.mab.T.U.....w..~.V.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{34F8F840-0434-4CDE-B182-CBCA2A0482CE}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 39 x 579, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):515
                                                                                                                                                              Entropy (8bit):6.740133870626016
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:6v/7su2/c30mqkg9VgFHe7Ll8UmJX/N+1Zmkk8f3lbtI4:4mc38gFHe18lkk8f3lbth
                                                                                                                                                              MD5:E96BE30D892A5412CF262FEE652921CA
                                                                                                                                                              SHA1:8190A0BFE21D04BC6F3A406E91B87CA69C03A2DE
                                                                                                                                                              SHA-256:0E31DA4DFCFF4A36C64C1CE940362D2309769F36369E4C43C317D5F2FA15658E
                                                                                                                                                              SHA-512:D647F51ABBD013226A6ADD0D551D058C633F867F9AF5A9E099B85D6E291D220F7B85958B07381CD4C7C4F72356DBAFE2A86932AE398E28C56CDDF0744E92EE24
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...'...C........b...`PLTE..................................................................................................bKGD....H....cmPPJCmp0712....H.s....9IDATx^..I..@.C..<..?mo.#C((.J}...~..B...b.I.i.\<.e.....(p.I.EO...q.x.......dRz....K..b0.:.<c.o..0.x\:...F....I&..ap....."P@....DO...q)p*..@Y.CL2)=......1.........4....._.G..^`..lDO...q...X....SL..z....K..#.L#..I6..ap.Ls.,....7&..ap.p..lI...,GO...q.....k.n1..4......3=.f.x.$..4.....o....x.$+..0.x\.,&6...............IEND.B`.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{3BBE9AD0-5C3C-46A9-A804-CB303B2E0AFF}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12824
                                                                                                                                                              Entropy (8bit):7.974776104184905
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                                                                                                                                                              MD5:2628353534C5AD86CBFE57B6616D46DD
                                                                                                                                                              SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                                                                                                                                                              SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                                                                                                                                                              SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{40600A4C-ACDC-4034-95EB-A54118DAE4A4}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 85 x 470, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):11197
                                                                                                                                                              Entropy (8bit):7.975073010774664
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:p9wNdtRKcVHso6zsqm06xaqZdingVzLZ7/PGSIz/yycRTbChh/JzhbEx15RGb:mdtMcVHqgAqTinMzLZ7/uSIz/yTR/mhF
                                                                                                                                                              MD5:DDC3CC30794277500EFE4BC6667EC123
                                                                                                                                                              SHA1:EFC9642C1F95B5FC38764476AE481649C016FA0C
                                                                                                                                                              SHA-256:7F5B660A1A0BF46C75AAF19B4F77A0E086DE003EC03AFC1F58D871D55AA5BA9E
                                                                                                                                                              SHA-512:25232A84604C3959634D33090238FEC8D51E40AD84EB3A08BB8522A81BE1E83378649C014E98E1DFCDF46B7BFAC92D8D2429211CD11D7EE0334C9C3DF7C1B6A6
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...U.........1x5.....PLTE....................................e........................................................s...............x..........................o..............................................................................................................................................................~.............................m...............................................j...............................................p.......z......................................................x..............|........................................v.......................y..........................................................h...........................................................................P..{....bKGD....H....cmPPJCmp0712....H.s...(SIDATx^.}i@S..N....h...!..)....AI%..p.L."a..)..`U..,h..:O.b.:.j+.Z).b..zN.s..{O...&|..N}...${....~.....k}.[k}{.o^.D_..W:35ly..7rL....6n0.A...b

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{4471F875-D04D-4519-B61B-F983C79E6176}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 357x69, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):5465
                                                                                                                                                              Entropy (8bit):7.79401348966645
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:X0cZneDWlIKmXwxacOHHI6EhzNlSSDDgafbofgt7mGrw:XleDWlIJwQHihRdgu8imGk
                                                                                                                                                              MD5:8470F9A96B6C6CAD9EE60961E96D19B2
                                                                                                                                                              SHA1:AFE1F01FFA4E4CB06B1D770C9C59DA75B434D1AC
                                                                                                                                                              SHA-256:2DF453410796AEC7B9EFEC00059B6CE64BCF67313A95AE458BA600EA5DE14811
                                                                                                                                                              SHA-512:CAE5C2ED091BA49761F0348516D53491E578FB165F32F93AC7DAD927383E9A398B06229FAC6A8233777DF708E5001AE0037A1FA960293BDA49892C40B37F2240
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....C....................................................................C.......................................................................E.e.............................................8...............................!"1...2A#Qa.$34bBDSqt..........................................................?.....`0.....O...3Sd..@..5.0....Q.pw....;....!pN.DR....`0......N^...k.=.u.e.7{.b........?z....zV...M.....P:a.SPj.....WRK.=x.2.h..2..AS..s..A..|.Z/f$D.YX1pr......}G6._.~..)j...+.s.r".{..q..-.^@...#w|.H..*.K)....g...y..`0......2.w@.Ro.d....@...K....}...&... y..f.y.0.|DC..>p.[E.2......v..N.)Z..4.RF.D.8]..Z.|f/..+\ID.r/.o........0i..*.G.O..uj..RN. ....j...xnF...Q.Ls.U.c.D0m....z.k.P;f...b.=..L.hH.,./;.U..`sa.I...?*...I....M.0<.u....!..C..U.T.....s.Q......_..7K..*.....?....R\&=.<.u..oQ}WZ..Yu...{Fe3.h...@.s..mW.G..^....1.W.#[.q2.&u.c.G......`J./..X.C....M;.....3k$}.i.3...#/x.m.Oh.}FH]. ..5NNDIS.-.M~...6..w.d....P.;..k...........v*..T..L.P...s.!B.4..w

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{44A1A75C-A323-486C-8D36-D9F1599A66C3}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 3005 x 184, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12180
                                                                                                                                                              Entropy (8bit):5.318266117301791
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:k1bHyG/fKOOOOQJUg+g2S+kEm6alfsfsfn32:+bSG/yOOOOQ+g+gOab32
                                                                                                                                                              MD5:5C859FF69B3A271A9AAB08DFA21E8894
                                                                                                                                                              SHA1:3156302A7450ADFF4D1B6EC893E955D3764D4DD4
                                                                                                                                                              SHA-256:B4A8E9A67EE0B897615AC4CCE388FFC175AB92D9E192E6875C79A4E7C1B5BB6E
                                                                                                                                                              SHA-512:4CF518136EEBCA4F400A115D9B7BB0CAC9FA650BF910B99E15F04A259B7D3EFCFFD6796886FE09DB08C37C332B14BC8500845C09C8EAE1F2306F90E98D3C99E0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR..............;j.....sRGB.........pHYs..........+..../9IDATx^...dW...S=.dL$.............-.`...'...x.7.D...(...$.?cO....9S]=.v...Z.......{..wNuf.&.....a.k5~...._..\.yk..v.....}{._.Q...5...._9o.n.....}7.].1v..t......q....3.<..0<.p.......0....s...... @....... @....... @....... @....... @...X.'..U-..... @....... @....... @....... @....... @......,I......+..... @....... @....... @....... @....... @........z...r.. @....... @....... @....... @....... @....... .$.C.KJ[.... @....... @....... @....... @....... @........&`.=X`.%@....... @....... @....... @....... @....... @....../)m.. @....... @....... @....... @....... @....... @ ....`.)....... @....... @....... @....... @....... @....K.0.....J....... @....... @....... @....... @....... @...`.....\.... @....... @....... @....... @....... @......,I......+..... @....... @....... @....... @....... @........z...r.. @....... @....... @....... @....... @....... .$.C.KJ[.... @....... @....... @....... @....... @........&`.=X`.%

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{491FF115-1539-4DA4-8A6A-E8DD90E95A88}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:26:15], progressive, precision 8, 216x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):64118
                                                                                                                                                              Entropy (8bit):7.742974333356952
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:ORG4azGOKXzkEmR4bdRSbxONOoz0khbSb4J/5GZK5SWUlRwUYdv1M:ZXzGXzJdhRmgHfIb4J/5GZK5SWUldYdq
                                                                                                                                                              MD5:864EEA0336F8628AE4A1ED46D4406807
                                                                                                                                                              SHA1:CFCD7A751DFDBE52A20C03EE0C60FDFFA7A45B93
                                                                                                                                                              SHA-256:7CE10D1EA660D2F9CF8B704F3FAB2966A4CE2627D9858D32C75D857095012098
                                                                                                                                                              SHA-512:0CAA0C54C14571C279A75F0D5922F78A17803CF6EE1724D66819F7F5944C0F5B25CB586BB686A52808CDF2F8FEB3E4864052A914884054EF7DE44124A8CA951E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:26:15.....................................................................................(.....................&...........s.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................#.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....NC+n....<.=.7..&.8A56..@^.Q..\\...E.>..".&G.......J .'....$.I)........0.../..mv...D....<v0=..ugc+..l.o...=.c.......x.&D..{`8...v

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{4D7B88A1-BA3A-4263-9CBC-780C8FF43F11}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):53259
                                                                                                                                                              Entropy (8bit):7.651662052139301
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:dCiCBBenRYWDBCipMYGTbYGLHbXxoP/qEF+MU50qyJ30h2W474S/Aq/xc4674bi5:dCiIQXBCiwbDLHD0/sFyVel4Pi4UgE
                                                                                                                                                              MD5:2EE369ABB7936F8C28FF0ABDD224EA05
                                                                                                                                                              SHA1:FE9D304A7B49E31EAE439369ABC548E265149636
                                                                                                                                                              SHA-256:FB12D59B8BE911247BBAFDD416852E8B74B028005A141CB4DBBBA109B4B6ED2C
                                                                                                                                                              SHA-512:5CF396CA472C32AE988600176114106CB1619404DD899A3867A5AB43DC90583B771EF69B14EF50E56A21F038BF51D8463C6ADD2DE9D4CB523F6290E24A4DECB3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..AQa....q........"2..R..Bbr..#S....3$.....C.4v..(X.DtEUV.....cs..Td.5uf'Wgw8Hh........................!1Q.Aa....q.2...."R...r..3.t..U...B#S.4ub..C$d.5Ee&'7c.D%sT..............?.....?...k,lk^...M".Yo5.Qp.&s}b.m.:...W.x}.*.a......N1..d-n.-..^..b..TZ.W..."....F....^......ve5...^...2.:i...........~u2pK.z./&..u..L[I....Y....@y{|>..MN=:....Q[..H....a........|%..4fV....).....^.9b.f...F...p.=.W...aZ.........Z.t.n.....z3..[..lVh..\.N-.._.sK.y.._e.G.jig.a.7^....u...*.p.5.a.].........u/u..D.yl.XA..f.z..~.x.....N.....b=.uv.2.t.'.N.-.H..n.v.a.A[.Z.....T2...._...:....h..l.E..sm..a.3I...RE...fWb.Ek.0.#.)..Y#T...........u{....U....s.].7_H.2.`O6...P......}..4LR....]4.mid...

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{4EB8001A-BFB9-4E47-883E-AAE646FCF3ED}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):25622
                                                                                                                                                              Entropy (8bit):7.058784902089801
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:EhK81gTCyJ/Gf9Aw3t8w8EtdPeGDh6bEi1Ie1u4ZbvgwTwrSRh7ZKNpIGY:IjcRXwdJvtdGsUbEi1IeY8vgwTyC1+Y
                                                                                                                                                              MD5:F8CCFC24DEB1D991EBE085E1B2D7D9BF
                                                                                                                                                              SHA1:AF76C22A765434AEDA134924C517C84107F4FED5
                                                                                                                                                              SHA-256:7354001527AB554C44E7D6981B86DD933B7DC2E0D3DC8512AD3EECD843245C52
                                                                                                                                                              SHA-512:818BC3690B01B30BC571E4CF45EC8D1AFCAECBAB003532644381F1CF730A5B3486862D08F7579B2D3D89167AD7DF35028881245C9550B0DA23D1F81A720A9704
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!...1A.Qaq.........."2Rr.#.t6..B..3S$4..v.b..Cs.%5..8..cUV.(.DEe.&Ff...T.d.......................!.1A..Qaq...s4....2r..S"BR.3....b#C$.....c............?..D.."}:......&&...?3..W.q*.......]...m.Y.k1......K).J...uV.b.../.0.E.H..4..W_T.[t.V.w.9.x.qe.L..o.oL.....d.\.....6.|.o...}..H{Yn..E...6Y3.l.e..D.:,.n.%...t...m.........,+,..|..n.....6.*...f........6.../$../Vi..H...e.f.F.zn.).n.E..2sTn.i...Yb?6+H&...Bf..*....z.o.^7[..u.:o....t.s=.....(.s.....f.g....q9o.u1L.N...smzE..[>...+\O....j.<....j.c.W.............U..+.F/.'..W...T./W...>i01./....j.s."..Q...{...a._~OW...Rp.)*.e..W..Q4)<..'..W...q...'..U..z..g......U}...O....w....0F:.N..V.3W.|..'z0.]...j..U[v..g$D.Lc[.e...UW.m0+

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{501799BC-378B-4C15-9D48-0AA530799F79}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):14177
                                                                                                                                                              Entropy (8bit):5.705782002886174
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:EbgGcV/hlvpfal7rgYa8S7auAxwfuSTmCSNoFQ6NO7L:EbgGcVnpwimnd38FdQL
                                                                                                                                                              MD5:7CDCE7EEBF795998DA6CAC11D363291C
                                                                                                                                                              SHA1:183B4CC25B50A80D3EC7CCE4BF445BCFBAA6F224
                                                                                                                                                              SHA-256:DE35AF949D4F83E97EE22F817AFE2531CC4B59FF9EE6026DCA7ECEBC5CF2737F
                                                                                                                                                              SHA-512:560FB15A9C12758D11BB40B742A6EAD755F15AD10D6C5DEBA67F7BC8A2AE67C860831914CBCBCDED9E6B2D1D5F26A636B9BCEF178151F70B4D027316F94F27E1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!.1..A....Qa".q..2.....&...B%6.'..R#3.$E.r457bS.DUFV.Wg(.......................1...3.Q..2Rr....s.4.!Aq.S.aC5B$%............?...n.Liq.}.{#....3/gg.1.M +..~3...q..+=..:.g.i1;P)7.....q..n.s"p...wx........v.t.f;..L/..~....y.r[.r.....n.n3..6i..g..}../........3..x.L.i?We..l.......~..<.;..6..o.....N.t.o6.l..~.......<...m.V...Q.7k.u./wq.t..;.I...}..{...>.L..3m..a....yd......6~.f..~Y..}+..<.[w..'-..?.v.7...v.u..4.......1];..u.MO.......s..p..ms.'.O-o...O......m.k.e....)t....i>..E|....,iOyD|.{......g.n...cu....=..........h.\.Q:?g/?.I.3._...t...d.n.0.%y....S.Q....S.&K.w..&wY<....%.g.v.....$y..#,i;.=...t...I6..yO..o.d..w\k...~......)..rK.......].u....N....e.s..kU.u..'}

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{5128FD84-6E73-4C71-B7B9-494F396E2049}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:10:32], progressive, precision 8, 594x773, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):242903
                                                                                                                                                              Entropy (8bit):7.944495275553473
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6144:YVxOYlZX2kCWfYoFMXC/sBFC9r+4iEGM4rrcPoWmwkU6FJ:+OwZ2kbFMC/L99ifvokU6/
                                                                                                                                                              MD5:C594A4AA7234EF91E6C2714CFE1410F1
                                                                                                                                                              SHA1:C0F720D4CE3196852814D0B7347F0CAA0C6FD526
                                                                                                                                                              SHA-256:10C833E47BE1C8496F949A6B059C2D79212A4DD66BDE62116EA337FA4FE0B654
                                                                                                                                                              SHA-512:7313F6545A334F9E2DE5430B2DB5C419C4C8A40E075338DAFCD74970BCC6309786946E5DFB57531612BF4C6269495655706D920FD99922FDACFF9796710DA9C0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:10:32.............................R.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................{.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...v&.F;-v;}FH..Z...N..)Y.......h;C....G.0W..ww...MI..Z+..\.........c..4.1.~.Yo.Y6.&. q...............l.A#.~s?yYg..7ky...r

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{55E1C0AF-29EF-4231-A86B-632E96C42F02}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 95x498, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3009
                                                                                                                                                              Entropy (8bit):7.493528353751471
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:aRCTf+0hagMrbAZMJShPdvF/5OzlQFlDF7npkDdWvVBTEnBLT6NrgCX0:D+0YgMrApL553JtEdEVcL2NcX
                                                                                                                                                              MD5:D9BD80D40B458EDB2A318F639561579A
                                                                                                                                                              SHA1:83BA01519F3C7C1525C2EA4C2D9B40F28B2F2E5E
                                                                                                                                                              SHA-256:509A6945FACFB3DDC7BE6EE8B82797AD0C72DB5755486EE878125A959CC09B59
                                                                                                                                                              SHA-512:C368499667028180A922DD015980C29865AEF4A890C83E87AE29F6A27DC323DD729E6FB1C34A2168A148E6A7A972F65A5FC8ACE6981AF1D4E7057D99681CB366
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....C....................................... ! ..''**''555556666666666...C......................&.....&,$ $,(+&&&+(//,,//666666666666666........_.........................................:.......................r.!12BQ...3Aaq.."CRb.....#4$c.S.....................................................1A............?..p..-.....u0$.......l......)..o.FTd..DG....... .t*e..jO..Z.U......r..j.O.,..VD./.....V5D.&......A..Zi....E.N....*..........#..M<|.2.Y.../QO.x.cTM4......+.F;V.x.de*....]e..O.x.c\Y........r..j.O.,..T...hw..k.^.[B..J.sEl.w.x.m.5%zzt0..T.......b..<\.3Q..W</..!.xh6..Z..\.+M.o.Y..1............#.........|.a.l.KR>..U......e....@...\.1Z...Y...[....F.6.t.#..Z,.x.Q..[`.X......#........W</..TM..-H...V....Tf..........r..j.x.df.f.....#..l.KR>..U......e....@...\.1Z...Y..Y.us....D.)....Uh....FkYm.m`P...W .V.g..FjVj.\..1Q6.t.#..Z,.x.Q..[`.X......#........W</..TM..-H...V....Tf..........r..j.x.df.f.....#..l.KR>..U......e....@...\.1Z...Y..Y.us....D.)....

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{55F5EFC5-149C-4832-8007-E95E611AD22D}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):40884
                                                                                                                                                              Entropy (8bit):7.545929039957292
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:MCBOA4d+ElOXJ/3pI7cRBiL7L6qERqGz65WXzZqJsKQSbIsTT6XB:hIAU+2cGdLX6qBG4WDZl4Ihx
                                                                                                                                                              MD5:7379775A1E2AB7FAB95CFFCE01AE05F3
                                                                                                                                                              SHA1:3D3DDFD8AC7E07203561BAE423D66F0806833AB3
                                                                                                                                                              SHA-256:9301DB6D2D87282FCEE450189AEACE16D85F64273BF62713A3044992B6B7A9E9
                                                                                                                                                              SHA-512:4B5006E620E80D3A146944649CF4CA619782CAD7E8C4CD0D1DE0EBCA0FA05EACB7378DAFCEED3E26F5698B07F19604614D906C8F51F898660E2F129D8DEC6F62
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1A.....Qaq....".....2....BR#S..br...3T...C$.7(Hx....4D.G..Xh.cs..'..t...%...8.....................1...!AQ..a...q"2.4Tt.......R3S....Br...#s...Uu.bc.de..$D..6..C%E..............?...z...;sB.yv...........]t.\...n...../....m....M.=.3G+..x+.....S).*&.J../..8..O/+..sG...p...<!....~.c..C.w..,[oHom.wc-.J.~.......L[..6...'..i_..S;...!Y.z.q].EK..M.x...i.x.+.;.+...}....#......f.)........e6V..p.;........s.)..Ml.J......IU.6...<9+9.^..l..Y...[._...2..^..j.ia...._..3.;...~..<3...;......z.^.......]..Qk.,...Yk...3.3Jy^p.}....q...I...&..t.......;..9.g.GH;..'...%...)..[..y..../...zCn..>...'...1e.Y..;....]..7...N>t..m-.j.............H^..T\.q.ru...}...eTn]I'r.^].#..wOY....v

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{5871238D-BEB9-464A-931F-701C8F0FFB10}.png.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):6078
                                                                                                                                                              Entropy (8bit):7.969745850757125
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:w1RSgHRuX5Ybw8aa7/or8nb/8vDrDc6BquBK2I94Pp9ZcaFsZ83c/DQ5pnBw/86W:w10gHyYbpvDf/8vzZBKx9uNFsaM/U5rl
                                                                                                                                                              MD5:E6A02DA72CBEA3ACA29C49AAA26B68D5
                                                                                                                                                              SHA1:10866A1CE12418FFCE3892BCFA365B68ED53C67C
                                                                                                                                                              SHA-256:085153ACFA44D8689AC5AD93F124EEB8D2ADE3E69F56128FC2AFAA8F9E37CD4E
                                                                                                                                                              SHA-512:14880DBFDCFC6BB75D8EDD693DBFF0B0DBD38E505556AC957B348F976024312B63842A355562AF2F10EE307BCA6549DB43BE59926BF614BE4B4AE8FFBF4A2532
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....e.`......eB.A...Z.P....u=.C..`...s..NqT......8....{.....x..a......Tu..a..s.y.Ms...\SW;.L....Ou.....g*..XP.<.L.'....).M..d...?.....~t...K....'....,.....F'.....DnO.T.+l...K(5/&.....{.;O..c%..{tSX^.y..-...."...Tk...<F.z.{..n`....YZ....y.R....v..+q...!.=D......{J.....F.w..,.U..H.......5r....jC..0/]}.3...PEJ...]|7..xNAd.5.#.3RX(..xc.._G..E'.UL...........]eP...-...K!PfH..;....g2.3J....8x.?0.@...sN...'...D.O.2..e.{.."}N..~..@9..Bg...P...`!.X....j.Ru..6"O..x(..5)#.b......l:....."....a.O.c..'..Z.B.5Gk<...B.-.@.S:]x.G.......s..7.`....^.F.~.B.....iF..t6.V.k.\.l..^W...........s........a.y.1..a.....8i....w..+..R......=...`Y.P.....b'..........j.x.<..,i..Z...(]..8..0..ge.[..P......W....V.....=......V.Yi...Ibc/..U..~.u..r.-..M.. ....^..5w..>.P.mD.&..:.m......2.@......J.|.SD"..W..........ze.~./pq.i...X. *......e...<.6.>.. ...]..5!.|q......}.}.KWZ.......)..t....4..T.\.S+`.sjm.....Y.....!.z..m."...Vm.(%..]o...DlILe...lM.^...X....X..G.XN..

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{58CC01DF-6B69-43F0-952F-48A9181736F7}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):40035
                                                                                                                                                              Entropy (8bit):7.360144465307449
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:MQhziQo1RKGlyyzYjlxuxwRUj/BN837xRmwH2uDTCn8qXFQziN:ThzrSzalg6O563l4uTC8q1Ig
                                                                                                                                                              MD5:B1DDD365D87605F96D72042CB56572F6
                                                                                                                                                              SHA1:ADF71DAD1A62B8A58A657C2EDBDD665A19EB846B
                                                                                                                                                              SHA-256:06E09DE80C3F32254DA4FE6B2CBAD7C05EF144DD54B8C65745E195BBF7317A2E
                                                                                                                                                              SHA-512:9C686092CC9524F34EA6CEC9AAE936A6225BCC54DE38DE1786EBA8F532959A80FF885E8664A09E4C318D7CA4B278E807D3D1F135BE55F30979B844FF5EC9699A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!1....AQ.aq.....".3.5...2B#s.$%..Rr.CS4&6...bE'7.c.DTtU...d.eu...VFfv.Gw.....Wg......................!...1AQaq........"2..4..Rbr#3$...B.s5Cc.S%.D............?..^.f....R*.N{.{f.....O.r.V.;U..~...U.(..>M._.yI.{8,..^.t...s`...j.O..U5t.&&..h.G.6Da.;.....J.......E..QD...C...}..N...tR.....~..].J:.V$.*.r......]...W......4.[.)6..Y_.....4...........m._'HR.a......]U=.....n...0.W..]..K..){.+...w...f...<|..1/.|.....b..-..y....]U#Ctn.7m.._.|..2I;|....tM....q.q.}.N)....'...9&...nR...R..}.........m._.LZ}u.../K....9.~..?.{....V.#..dx.Zk.:=..:.j].....E#....E~w%....J..[S..[......gr...vb.r]..<..ut..i...[P.w....:..Gkn>......#..m...9km`......t).up.....w....VOR.{&.nQI..}...wD.7Ey#n....MO.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{5C09A7AD-094A-4E40-B140-6B606A4002F4}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 70x626, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3428
                                                                                                                                                              Entropy (8bit):7.766473352510893
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:/hdu7isPwAp7zesusUyYAatNG87llTONQYS:5di5tfuQ9atNZlaC
                                                                                                                                                              MD5:EE9E2DF458733B61333E8A82F7A2613D
                                                                                                                                                              SHA1:A86704C969F51B86D6A05ED51C6C60214ED9FA89
                                                                                                                                                              SHA-256:BE4F0E6C89FCE91B9EBD2623567F7DFC259E0E3C77C9158742B8F64B724DF673
                                                                                                                                                              SHA-512:BFB5D6DD6B66EE21E946E90D1E482384CD10244308562DDA814189602681DADDE5752B80519E5B8515F115A71BD6BB4317A59BE65B8B5E3474AED119F8303569
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......r.F.."........................................H............................!Qaq.."12.....#3ARbr...$B...cd...&CSu.....................................+.......................12..aAQ.!#q.."................?...#...3.Za......rV.5&...../"..i.t...j..W........d.FL.V.2K....]t.f.d.NK..:.....f...... ......2.[...#..D...ZK....p.z.E.N..T..L.-....1....2.\.6FIr2..zS\U#..........fB\t..5J..~q...D....A.......!....MY..../.HY..../e.M.Y.n.~..,....'..Pc...l...d2..m.f.it$..qx-z*...._..].cOO....n..&.....FIA.....2J2..d:<qc..6.I.G.N....f.K..Dx.-.......`....2.FZ."K7.r}..<.P.Z.da.Y.....8..s....G.....b.e..g .S.......FL.Z,&..q.MG.J+..x\..m...qN=.....)..`...&Y...S....u6{.z.g.....@......FL.ZL&.Iv.w..8....U..v...*.q.B.v_./A..#.#.g.j........*J;...u...W.Ao...%....#$.....M..^\{W.SO...s,.N.....c).,.B.Gv...."k..z."..S]H.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{5EE08DFE-A0DA-41B2-B317-B4068E309576}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 613x144, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):29187
                                                                                                                                                              Entropy (8bit):7.971308326749753
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:RwjBOlCk+nYnGagKJWJhwMJiRO22ZIm4VXvXx1tA6BQs:i8snY3JW7uROlEfbtVL
                                                                                                                                                              MD5:DF99CAAAB9A7DE97B63343E60A699AB6
                                                                                                                                                              SHA1:B84334135CFB73BC6EF55F85926770D5AC6DFEA8
                                                                                                                                                              SHA-256:74C131777E7C437FD654427417097BC01B0813BA8E1E50E4B937BD50A1BEBCDB
                                                                                                                                                              SHA-512:5D15AAAA8B71DDFE01A7C0ADE16D9E1F5E9AAE484BCD711B38CCB103ED9564CAAC23A0031471167B660E15972D70179C2A387509B213C05D60261042A0456025
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....C....................................................................C.........................................................................e..............................................`.............................!1Qq...2ARa..."#.....3BSbr...$4C...Tcs......%&DUd...E....56Fe....................................H........................!1Qa..Aq..."b....2R...BSr..#...3..Cc....$%4...............?...b.d.8T1.;#.S.DO...~.R.......3.xe...z.6..."m..k...;*.'.f.5^.....m..<$....8.R.j.D.v..>...*dT..vGbt...I......sEWp.r3.. ..G...6.....w...l.S..q...b.....-R....^Zu5+u6...A..Z].:...5..Uzn.,l.L.....?%.*.S.+zVg7.=.s.Q.....8..:,c.......ZE...>'IF..W.0.d.......c.e.d.V.t..S$.DNR.[....g..#i.$. .U.SK2.....k...J5u u\R.....T.[4..A.O..,.T..................] .i...B.m.^f....._...{S.....<......:..|D...+...NA....Y.^f.1|..%K~1..B..^...S..v=.c..g.tX[..kTJ..t.gr....R..@.F....5j..2.K.9..g.1N.....*.U...^w......>+.l.v...@N....%Qd...t.Ni.....0;lggm...K".+!.,.....[J...>..?f.]._;

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{5F2AF04E-F199-4CEE-865A-0ABED25456FB}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):67991
                                                                                                                                                              Entropy (8bit):7.870481231782746
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:3PC0XJjsmsKuZRG1pXuZ6z3wARnV9AEnieCc7cllJcHJ:qyMBzkUZ0gq25c7Z
                                                                                                                                                              MD5:1271B1905D18A40D79A5B9DB27EE97EA
                                                                                                                                                              SHA1:9618608FBD7342DE6C71220A36C3F4995BA9C13E
                                                                                                                                                              SHA-256:5B321A4D81BD499B289B1755F6450A42047C494DFBC112DBD56DA4CED2C15C1A
                                                                                                                                                              SHA-512:C32DD26047F6B8AA061085B38AC2B8335868E1BFD8731DB65544309223A955FA4BF45B06AC8D244408658F51A1775B6F19FF0FFC804989DE706DE8EB36F1436F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1..AQa..q..".........2...BR#b.r.3...$.'...)..C%7gw..(.S.W89.......................!1.A.Qa.q".....2...#....B.t......rc.$%67Rb3s&'CUu.v....S.d5.V4T.e.............?...?..Wj.e.e.......w/..E..eOw_.....6......u..C6h.,..;.g.D8Z..-)O..jy..e;.u.g..w..[.L""k'w.......'1'.[......=..P...S.9a.V./O....q=8xk]...........9......F...e9'....9.O.... .&.....p......c.4...mr...?.......L..'.....0....+..|_...POM=7.?.2.a....};.Z..y./....>./.C.<...;.....|.1>...........S.8.o.O...+..n2...k../.X..9...Y...:.....\...Dk......q.K..\.Wuh.!Z?.mu...R.5.A.S.h.0..[..v..+M.....aUi*.k..?#..._...X..R.&]..[..;../]L..f..V......*.e...ut&.#.J.5....c%..o.$..v.<K.6..T.IP.....6X.*.uf..t0^..-.)m$.!.q(.j.f;..WB6.b.B..R.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{5F969F84-5F34-4AF8-8D36-D6D6A1668750}.png.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:OpenPGP Public Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):6072
                                                                                                                                                              Entropy (8bit):7.969054209222546
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:avU3RpSJk4d00JXxht/H6T6jD11UXgxge+iI7g9Soe2o29nGZDe8W5OQbOKT+:aqbEdRX1asi0dVA3YnkJW8Q6KT+
                                                                                                                                                              MD5:744E367DC54F4F80BB8568134E217DEF
                                                                                                                                                              SHA1:F4DA106DFDE68CA8708D5BC1FD868CB1AAE7A98A
                                                                                                                                                              SHA-256:CFA78592B87FFC4FE309D53906467167B2D1D27248222747FDF84B8A4265B05B
                                                                                                                                                              SHA-512:1225E7C52B60517D50500BB12A11175597E359805ADF9DE0B853151946FF13FE9C0EB156E29207C61546FBF2AA377C72D053173C922721FF3D0DFDA2AF3556D0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.L...1.O..x.M.6........*.a"..~.a..;.@..#a..+...?./.b.;`..zjv....H........'......N.#...i...\....YX..e-...eRn.;.w.R...Z..?.....a..t.]k.6.n..Ef..f...+........*].V.e.Amc......].<...............#AFv......o..U..n/.u......V.j..|.....O.G.P.x.A=UUj...>4{.;Rq..zF{F......,..2`..$.....BE.v....._"o....l|.|....186n..t.r..5.Q.4+.u.WO......^..N....C..x.C.DQ8.. ....jl$F..bj......F`q?.Z...Fe..W|...N....{........7dK.L..H.wxBk.M.[...[...".b&_.....B|%3/._$C..6}m'.w...s.....tT..$M.X..jgNjw:.VD......#=.mB>{+'o.1....A._...z.}LE.....!.|...|..../#J...Y...H..J......b........U.d.37.U....MF9m<o...>)R.L.Y..[......eqx..X,...~./.}[eBL.3"$..|P....;.........N..A..0..)'S.p...".k..>t...s..h....,.*...T<...{|.....w.G.(9..Y..:.y`O.u..es..^7'%n6......F.~2..y....KD4.'..p(Cb.W.3XC.%tldG}py..(..h.K.uk`_. h......Q>6vF3.......x..>....E..j..gn.%Lkw.S....N.p.]F$..s...../....;kF.Y..Y..e...=.F..a.....+..tK..C.......;'[O..I....|7o.h..0....4..P.. .7......Wc.hd.v...u=.....P..J...Z@.d.xq7.I.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{5F9DD609-8D87-46C3-8219-3A8A93AF797A}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):34299
                                                                                                                                                              Entropy (8bit):7.247541176493898
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:BrSX4V3P8AIc4KLkHeXRUer0zrhOmXfvG0yH82I:tSXuIc4K2eBtswKsHg
                                                                                                                                                              MD5:E9C52A7381075E4EBC59296F96C79399
                                                                                                                                                              SHA1:BE295AD24D46E2420D7163642B658BF3234A27EA
                                                                                                                                                              SHA-256:D56CEFE9EE2FAE72E31BDBA7DD2AA4426EA22E3CEB22EF68C8F63F9F24D5A8BC
                                                                                                                                                              SHA-512:95CC96DD4459EBAE623176033BA204CCDC50681A768F8CBAE94C16927D140224E49D5197CAE669C83C77010C5C04C1346CF126BEF49DB686F636C5480342A77F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.......................................................................................!.1..A..Qaq......".#4.2r3.$.%...B.5U&6....Rb.Cs.7..cDTEFVf'...S..dtevw.u.........Gg.....................!1..AQ.aq.2....."#3.4....r..BRb$CS.D............?..5..............#....v.q.m.}\..{....;...r....h.....J..q|..'.;\..6..v......e...../.k..|.8..i..|..]..3e.m....n..Z.GS..n".y..w.-...[a...7A.....i.4.)9\..~C...=.........s..\V]c.D1<./.g.l.&v..~.h..]....zb>G..y:vNS.\......LU....t.{*..Z#.?..v-...wn.rR...P.....y\=.v....../..9_...m4...V.|.+.o.#.......xj....}..>.s.>C...m.[;.>.p...=^.i.X.(..1...{.F#N.W...xi.z...4..u[{...yO.....8..}\..2...KlX.nbya...2.&.F...R.b.k.7.GV.x.h.y\.Q..O<\>......-...=...r......\......Z.Z...Jf.'....z..Y.q>.p....o..K....h..R..c.lg?......A.Z...Y.q3.L|.'5...

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{650A34BA-B6B2-43C9-9A35-BA2AAA32D388}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:08:07], baseline, precision 8, 595x450, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):59832
                                                                                                                                                              Entropy (8bit):7.308211468398169
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:HS9SYFtN0+CRa9mfJy4zBAiIJhzrkHDV2hJK:yAmta+Tyy4zBIJW5WK
                                                                                                                                                              MD5:DCDD543A4E0BA2C1909BA095D46FFBCB
                                                                                                                                                              SHA1:B86C89537138FE07255354202D3EAD0B53B3C54D
                                                                                                                                                              SHA-256:28F334B77068F71F5F92A95695433B950610204A0E5580CE567DB8FAD4993ECB
                                                                                                                                                              SHA-512:5408C3259B7F3288A4BEB04342799AD5FE3A6F0EC7E92353B29B7E7E538DFA9903B39637226919E0421BC422635D25F5F8069DC7441864DC03E1B909BF5C2C84
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....fExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:08:07.............................S.......................................................&.(.................................0.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................y...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?......;R~+'....xh..~.n-}.......Te................^B..IU_....._...S......h.......!....9...A}6V=J......C..c.....Ug.Wh......

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{69EA0A8C-E284-4035-B17C-FD147F6DE026}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):55804
                                                                                                                                                              Entropy (8bit):7.433623355028275
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:gVvci05lhVbfBcWvBLeynluexaWqzww/u5:gVUZhHDljaHww/u5
                                                                                                                                                              MD5:4126992F65FE53D3E3E78F6B27FD49DC
                                                                                                                                                              SHA1:BC0D76B69310DA9B909D3EE4CECBFE5F386BFB45
                                                                                                                                                              SHA-256:3FBE3C1C238BD7DBC67F8CFF5F3BDDFD513C96A9851B9616477947D21DFF4B2E
                                                                                                                                                              SHA-512:624853F5E56D224C8188F122B2C4724F867D4099E7FAAFB9C945BE7E2907900ADCF4AE97AB08909CF94E96FB6F381E3B6396D560D93EB2731E4E69CBFE628F10
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d..............................................................................................!1...AQ.aq"2.....BR..8x..r#..9b....3....CS$.'.cs.......7Gw.(.4%5&..Wg.h......tEVfv..H..........................!1A..Qa.q...."2..u6....BRr.#...b..3s..d...7.Cc.$Tt..S4.5Ue..&..%.................?...,...8..{..S.y.N....%..q.8..H[5....o..xg........)c(.eO.YO..._D..x.U.....%.S.r.r._.^..Su.h.Q.t.:.#?....x..B.S...Q.....oqF..%..8'.qx....%.2JKjF..{y.w0.*a.RMb.c.Q{%....eW'..[IV..'ZW3...[...MN.....rO.:....$.i..7....Vrrr...I.r..M..Qo..j....q.^...N...J......%.J..)F...>$.....u........o...+......[...*..t....R}.I..R..S..GB..:......).6_[^Xft...F.1.....zP....,.#....MG.T..Q.F.....)Fi../.I...,%.voEb.b.Z..V3..FT.}..[Z{....wd.z.e.....QwW(.).t..\..'....:)<W.<..&k...caRT.X(..K.....:f...]...q..

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{6A76C367-49AD-4CC0-8909-2D72235BC9B9}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 40 x 650, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):647
                                                                                                                                                              Entropy (8bit):6.854433034679255
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:6v/71rwqZMXVs99W1YvpLp/Fvl+f43ocLtuplb+CrGotLRd:+wqWXVs99rpLpNvr3pIx3b
                                                                                                                                                              MD5:DD876AA103BEC3AC83C769D768AD39FB
                                                                                                                                                              SHA1:1833603AA9B6A7E53F9AD8A336F96CCE33088234
                                                                                                                                                              SHA-256:1262DD23AD54E935CFA10FEB1BE56648E43BEF1116696CA71D87E6E033B1CA7D
                                                                                                                                                              SHA-512:946DB2277213104A3B29EC4388578B05027B974A3093B4CCAD8847397AA51AE308BC6A199E5705E1F901D6E4B1BA34D8DECFD6E5B6685184A307D749D7CFAEDD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...(.........xk....`PLTE.........................................................................................>.S.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.)..1..7w....6.*.H`T6.ha.k.............b!....Ba..C..P.4K..@.....h.E..X....PX+.P.-.....@@"...o.O4....xZ<...B...B..,A..y.s<......b!....Ba..C..0_p. .......=..,...i. ...=.j..N...........{4+...xZ<...B....|.....$.K<.vyE..X....PX+.P.-.:... .'p......\,...i. ...=.j........K.....%J..S+.....q..k.H.@DD.s...:..J.K.DDL.\.@`,.DD.:.(]..N....KD....A M.....F..S+.....1.sq........\.t..;..../...~k...4.DD.:..]..N....KD........@DD.s...:..J.K..[...Q....V......IEND.B`.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{6E96AA43-4F8F-4E42-889A-2B9843EA3095}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 40 x 617, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):827
                                                                                                                                                              Entropy (8bit):7.23139555596658
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:6v/7Hs2NwBW1mtjeSfaTHHy05riYUtr8y8PQvPYzzg979Reip0QPqc:oOsotazy4rStr8y8PQIzWea0Qv
                                                                                                                                                              MD5:3E675D61F588462FB452342B14BCF9C0
                                                                                                                                                              SHA1:86B62019BC3C5BE48B654256B5D10293FC8C842A
                                                                                                                                                              SHA-256:639EADAD468B6B32B9124B1F4395A8DA3027FF7258D102173BA070AE2ED541AE
                                                                                                                                                              SHA-512:E6EA855B642ED36FA82F8E469A826DC57EB0C36E307045FF8D166F67AF9242C87840833BE31FBE4706DC54100E999D6A3D3A78D0633A3114735818874AD34758
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...(...i..........`PLTE...................................................................................................bKGD....H....cmPPJCmp0712....H.s....qIDATx^...0.Cg.;......@j..2c.=~KP.[H~..@..8...?U.g.n.a=.=.).....3..u^(.....L....5..........8.}..T.f.n.a=.=.).....3..u^(.....L..r....s..8.....W]....,..9..G?.a..`c.z...E.p...)Y.P.....#....@9.7].....,..9..G?.a..`c.z...E.p...)Y.P...`b....0.b.+~{.Pu...1..<..0._.l.@O.y.(...V3%..J....s... .(g.+.qyWu...1..<..0._.l.@O.y.(...V3%...%R.L.Q..x..R.<t.o......7.............:/.E..j.da@i..`b..Z......u.>.?...7.............:/.E..j.da@.Dj..9.W....s. .....:.......L...">w..7... .....:..."...L..."..a....D..Ya.l....E.{.@&.|.._...7..D..Ya.l.....{.@&.|....0.J.."z.0s..s....=g ..>........"z.0s..s....=g ..>..l..1...y..g......IEND.B`.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{70DD5974-96D6-44E0-828B-9643D9ABD175}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):55804
                                                                                                                                                              Entropy (8bit):7.433623355028275
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:gVvci05lhVbfBcWvBLeynluexaWqzww/u5:gVUZhHDljaHww/u5
                                                                                                                                                              MD5:4126992F65FE53D3E3E78F6B27FD49DC
                                                                                                                                                              SHA1:BC0D76B69310DA9B909D3EE4CECBFE5F386BFB45
                                                                                                                                                              SHA-256:3FBE3C1C238BD7DBC67F8CFF5F3BDDFD513C96A9851B9616477947D21DFF4B2E
                                                                                                                                                              SHA-512:624853F5E56D224C8188F122B2C4724F867D4099E7FAAFB9C945BE7E2907900ADCF4AE97AB08909CF94E96FB6F381E3B6396D560D93EB2731E4E69CBFE628F10
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d..............................................................................................!1...AQ.aq"2.....BR..8x..r#..9b....3....CS$.'.cs.......7Gw.(.4%5&..Wg.h......tEVfv..H..........................!1A..Qa.q...."2..u6....BRr.#...b..3s..d...7.Cc.$Tt..S4.5Ue..&..%.................?...,...8..{..S.y.N....%..q.8..H[5....o..xg........)c(.eO.YO..._D..x.U.....%.S.r.r._.^..Su.h.Q.t.:.#?....x..B.S...Q.....oqF..%..8'.qx....%.2JKjF..{y.w0.*a.RMb.c.Q{%....eW'..[IV..'ZW3...[...MN.....rO.:....$.i..7....Vrrr...I.r..M..Qo..j....q.^...N...J......%.J..)F...>$.....u........o...+......[...*..t....R}.I..R..S..GB..:......).6_[^Xft...F.1.....zP....,.#....MG.T..Q.F.....)Fi../.I...,%.voEb.b.Z..V3..FT.}..[Z{....wd.z.e.....QwW(.).t..\..'....:)<W.<..&k...caRT.X(..K.....:f...]...q..

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{7C360C4D-3C59-42F0-82B3-2DCFBD69A87B}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 50 x 556, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):977
                                                                                                                                                              Entropy (8bit):7.231269197132181
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:6v/7QiFJaY/z+obuqFA4fypjQSbtBK+lcqNGSbb7XTJArRRzN5DjNRkPmu5cCbR2:x0QY7xbjy9pY0JPXLTWroeuCCbX0
                                                                                                                                                              MD5:B7F74C18002A81A578A4EE60C407A8D3
                                                                                                                                                              SHA1:70A7D4BB1B3ADF4397D168AD0D81B286F88EBDE0
                                                                                                                                                              SHA-256:95F59A0433050180D4C0E8858B83363D51BEA6752A8B7CA516A8677854D8F5B6
                                                                                                                                                              SHA-512:13186A7CDCE80BCA9D2238666D6D7A989FA1887EABFA5D8A9A63EEC304DFD4BE8EFF652205FA56E1D1CEE7D3680AF8C70A952AF73AB3C246400E8D4EBECBDBA9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...2...,........A....PLTE...................................................................................................................................................................................$.y.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^...0.D_.......cck.....%a...X.a0Y...-..!.G...[....(.r.H.$...1 .zq.4V.e|a.6.X..4..kl.%....=w....6..TN.....{.4..T/.z...../.....3..!~..t.#b..^.....E!.SFb ...-.....^...,..C.!.b...i._c...s.X.w.. lsQH..H.gKc@@...i. ....m...;Ci....@G.; V{..lO..\.R9e$..{.....P...E.+.2.0D.B,..P...56.?......K.6..TN....^z.4..T/.z...../.....3..!~..t.]b........E!.SFb ...-.....^...,..C.!.b...i._c..Y.O...?.9k2.M.?5 .n.P...,...d._..%M?....6....,.1..R.4.a.R.+..U.Q..P...vd..T........j .]@....."..lJ../.90.4...Y. ...9.%...{......Hc%.....i..%M?aG..H....o.q.......4.......X.d9.r..CI.O.5.Ri0?.s\b....w...>/k..4V.)Y....P...vd..T........j .]@....."..lJ../.90..2..MP..l..?....K.X.....IEND.B`.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{814957D3-C7FC-4C70-A146-188344012E6E}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:19:29], progressive, precision 8, 221x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):24268
                                                                                                                                                              Entropy (8bit):6.946124661664625
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:d2wiieoHTRh5a1HAteZCWOZIM+L7WhNjYn:8wHFHJ+/OZIKhNO
                                                                                                                                                              MD5:3CD906D179F59DDFA112510C7E996351
                                                                                                                                                              SHA1:48CDB3685606EDD79D5BCDF0D7267B8B1CCBD5A8
                                                                                                                                                              SHA-256:1591FD26E7FFF5BE97431D0ED3D0ADE5CFC5FA74E3D7EC282FD242160CE68C1F
                                                                                                                                                              SHA-512:2048CBA13AF532FF2BCC7B8B40541993234BD1A8AB6DE47B889AF3F3E4571F9C5A22996D0B1C16DD6603233F6066A1A2A97C16A6020BEDD0826B83BAD0075512
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:19:29.....................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................$.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....)......[]t.\Z..g......A....&D.$LH._..X..Xl...`....cZ.X.........>......f.Z.X...]..~L.S..@..I$..I.IO.....x...s.g.[f.h{9..

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{8191241B-69A2-4D30-86B6-3896F7849AD0}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 813 x 99, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):99293
                                                                                                                                                              Entropy (8bit):7.9690121496708555
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:Moq1jVORV5NO5xLCBaaNk4vhpCr1CH/DATOQlWvHMHojiaAMrxArLFRZPj19AWFz:eVEbouBaIk4T8uDGOQlVHvaAMkhDh95V
                                                                                                                                                              MD5:EA45266A770EEA27A24A5BB3BE688B14
                                                                                                                                                              SHA1:9F0B23B3C8EBA4FC3C521E875EF876FBE018F3C8
                                                                                                                                                              SHA-256:EDAD0F03E6FF99FEF9EF8E8B834CE74F26CD23C5F8C067F5CEE66F304181E64D
                                                                                                                                                              SHA-512:D4EE36BDA897BBD643A699A0332DD00DE9CDCC6F46D861789BAD259A4BF87868AE3B4CFAAB6DFAF29941C7055B77A95D76BAA86A4A0DB2BF3BAF7E3317F03EB9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...-...c............sBIT....|.d.....pHYs...........~.....tEXtSoftware.Macromedia Fireworks 8.h.x....tEXtCreation Time.05/15/06.8.p....prVWx..[Oh\E...y3kv........`.%m.R..6.1.4).o..Ki...D.......P!.].=..K...C[....f.}o7VPJIg...{3.|....d.....i..=.4.u0...n y......@j..Q..f)..mQ...4-SJ..9.d.?..5\-....:b.W..i...c.5..{..pj#.....B1C/.I.......].Su.k?.2..:.9Q...5.U...UZ...e..U.c],..2.}...1..)W./..Epr.Zt.....K.=..{......e..."...v..B.4.#....A.V1.".V}t..[..2f..Y..V9.".6.......(..gbm.P.....Y%2.c.z.:Q.2.<tYF.....u.@..KJ.;u.q:.].....$.....V....Hqk..DW.l.e.j.Z.YP?:'R..*.<........6...m@..r..j2..HK"|..L.Nc..D..y.9..B4$.......`.3.m1LE....7(OU\+./.O...%6T..w......h....).I.&n...*......#..W.41...5.#.`..I...<.?.|..*+Q.....#i........$,..n...`.s....[..E. T.w..j.,&-.r..;a....#.>(.P......f...MU\3*..;B....)..5....z..(....-...a.....}y.l..E...z>......&..g.$.....*T...N....E:./.>..#...^..E.0..%......(..@..W.X.NDM.<~.]A.>..fW.O.y.'...Z...h..).F..

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{84A90E29-6229-48EF-AF69-DFB9920D5CD1}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41893
                                                                                                                                                              Entropy (8bit):7.52654558351485
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:pZvVQkUbOHxx3pvVmO5rsP5gUdXwFMuv53knzyncaXgRDqPU:pZkijV5wScXwFMYknzucaXgRyU
                                                                                                                                                              MD5:F25427EFECFEE786D5A9F630726DD140
                                                                                                                                                              SHA1:BC612A86FF985AB569ED1A1EA5FFC4FDB18FC605
                                                                                                                                                              SHA-256:5A36960DF32817E8426BD40A88F88B04FB55B84BAEF60F1E71E0872217FDB134
                                                                                                                                                              SHA-512:B102F34385196D630F198667E874F25ADBC737426FDAE0747EC799B33632E5DC92999C7C715DC84D904342738930267AB1709870BDAA842243E4C283FE5E1554
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................!.1AQ....aq......"......2...Xx..9BRr#.b3$..&..g.8....%F'G.(H.Ss..D5E..v..W..Cc.deu..7w.h.).....................!.1....A..Qaq...Ttu.6..."R..5...2B..S....bcs.Dd%&r3C...#$...Ue.............?..R...%.R...t.MQ*.l...v...V]..n...Zw....M....4..F.&&bb0.:]l......ay.r<..3.l.Q^.........I54.N2.8..2s...w..r6.......[1Zh....O...9..>...B......x]...r.\.\..v..~....y.QT.3.......=....r..}.l.....o;....M..C1....w)...+o1f.]...MoA.E..s5..i.\....miGsy..m\.Zj....I'YU.\tU6La5v.>.K..m.]1.......k..0....</5v.V7lY.e.vV.+./[....f..u{....s.}.Rb.Z.....Y.6]..m....V.\...Mr.=r...K...l..%..m^.......X.(..fG..[F*ly.jL.a4..vs..o.e..q.9km..w1.yg.....r_.*h.n..5i.-.{Y.l...<...'Or.s..Z....../JP.....\FV.S..............m

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{8E8CE754-1498-4F96-9936-304C5FC22E66}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):39010
                                                                                                                                                              Entropy (8bit):7.362726513389497
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:6tCjwO+E+KW0ZtOgepcoWW4pAWQ6/KWcR474HOAZaDfK:68j+E+KW0HOgep/72/NKWcRNefK
                                                                                                                                                              MD5:9700DE02720CDB5A45EDE51F1A4647EC
                                                                                                                                                              SHA1:CF72A73E1181719B1CC45C2FE0A6B619081E115E
                                                                                                                                                              SHA-256:7E6A7714A69688D9FFDF16AA942B66064A0C77FCD9B3E469F89730B4B9290C3E
                                                                                                                                                              SHA-512:5438921467D62376472007B9EBF3C35C9D9FE3EDE04D99A990129332D53EBC8EE2555C0319A4F7C0DF63516F29CEDF2171D8B6DC34C9FCD075C2CA41EB728660
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!1..A...Qaq..".......2BR#...b%&6..'w.r.3f7W8.s5EUeF.g....CS$4.Vv..Tdt..G..(c..u.Hhx.......................!1.AQa..2.q....".s...3.4BRr.#......b.$c............?........uf.....t...;..[...W.h.....-.k.f..i.u..KQ..b.F...rM%/.8n.S..=9.....G$O;.f.}L..N..U._i.[.X...3.~....S.~..+t$...c.5......{..X/..#.G...}s....6......^....o~.$.\WA?...^*w[O.~..6..~....a....~..:..0.......{O...|.s.u._w.........i...........{K...._.?.../{.....A..8....<g.iu..<..................X......|]v....D..9.k.w.|-IF.Tv.-.&.........."'.4.b....z.._.Z.....G...u.xyt./_.q..m>..S.V.Xdc.bw.T.W......g..........}s.._..?....U]_.......`......>.|'.~xH....,...?........?.q....o../..R..;...Y.G....A"?......?.<..1...w..o.M.........tco.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{8F3B7CB5-8E89-4B7C-8E86-25BA8F1DF17E}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):79656
                                                                                                                                                              Entropy (8bit):7.966459570826366
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:2kuUliOeU4os8ii3nF3Hxro/qxXD9u/kjYgMZqoEs6ZUldm:3uUsOXYIAixR2k7WAZV
                                                                                                                                                              MD5:39FF3ACAE544EAC172B1269F825B9E9F
                                                                                                                                                              SHA1:2D40DE8D90BD21D56314D3F99CEF4FBAE3712C0F
                                                                                                                                                              SHA-256:70475431CCA3C91A4EFA3B8F04864371D2D3A45696674A1A0562FE9CD8DB287C
                                                                                                                                                              SHA-512:3B9F3B32696AB7779864E83DC0C45960114A130BEE0CF4D0643DE57FF952171E5D775AA49141EE31A28A9B5D052B26EB421F26EA736D7EF4B3A7EC812CA411CB
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!.1A.Qa"..q.....2#..BRb..r3$.Cc..Ss.4...D%5&..T...'7....................!1.A..Q.aq..."2.....B3.r.#..R...bc$4..D.s%............?..Y..T.o.\......=.a..j..'^..s..[../........Y.......<...(..4.....7y..Ln.[9.cK.ilN...u@$.V.9.V?3..s.KL.z..w.jW.C.............@.~+.o?o8...k....,.m..9.".....q.....d....z.W...q...~...'..e..>..f#...S.....F....pU.......7..N.vfK......S..G.#.....}.c.........RXt.bq1.`.....[+8\.*.N..:......}.....r..........')......Na...&...m......c...a4_%d.............co..0.n.L.Q..E.Lt..y.|..F..4.i(>.._..\.eNL8..?z9I:hLgC.@.p....g.t......'.I!d..?1f..R..........|..4.wJ*..%g..~0bt.....*...v.......O...:.~.>~..o.x...9.@>...s.&.E.0/G.c..t.<..F.t.A.z. ......;.........Gp.P

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{9074CB04-B243-48A9-8779-952439602DB2}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:12:29], progressive, precision 8, 598x766, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):70028
                                                                                                                                                              Entropy (8bit):7.742089280742944
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:ub4bgbB7g9cKCmSzaNF0jAdAzQKTEFBQqUp/i0yG1pidLHTVX:ub4bIB7Qg2OjbzjgWp/i0yGCZx
                                                                                                                                                              MD5:EC7811912ACA47F6AEB912469761D70D
                                                                                                                                                              SHA1:C759BC2D908705D599B03BDB366C951B11F99A4E
                                                                                                                                                              SHA-256:FBB4573E3BEE1B337077691BEBAE15D6FAC52432405D31396D526D7694A8283D
                                                                                                                                                              SHA-512:881828150993A8C56E36CDA2051D89C1F6E0322643902C9506392C163E8734A2933A46486F40E5BC8C8D0164E180605E52620EF22FE14540AEA787A38B22E98E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....7Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:12:29.............................V.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................}.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....H.yM..? .Z.. .^.x..p.8.A...K.... .\{..)..y....t..=.^y)..v.@.W>. .h.. ..p.:.\)(.$....$.I).....!....E..Z.....&.5.).

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{9108A11D-D678-4BC2-B0C0-AEE6582B4CD3}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):86187
                                                                                                                                                              Entropy (8bit):7.951356272886186
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:AbmHwD7za0syWMetp3TdPFzoJamVdAQZCiUit9qbYN6LerhWMzIWgN1EeaYhJM:1QnzsyTeP3TPAdAQZCi5qbYEKrhWWMNO
                                                                                                                                                              MD5:FEE4785DF76E93A9DC2F4501CBAEAE12
                                                                                                                                                              SHA1:8FB4527BDE05EF208FCDB168098A07707C27501F
                                                                                                                                                              SHA-256:F091DED5E283AF6848670A3172E7C43C6099875D39B3FC69C2BDBA914F609602
                                                                                                                                                              SHA-512:7E99D33151A0D3873D6A819C98EA8E62D928C087B7BA2080F11C7BCF746AD60A44D4FF6EE3D2D2E8DFA4BF1FC6285ED56BB83F91C2FC6FC4FDFF2000105F10B1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................1.!Aq...Qa."...2..BR#...br......6v.7..3.CSc...$4.s..&dt%u.f.......................!1.AQ..aq........"2.B#....Rb3..t.5u.67.8.r..$....C4.cs.Sd%.DEUe&.............?............w.....c.....i.A.....3...7.......7..P......%.........?Th..l./?.;.....$}..=5Oa...F.c.A/...D.D..]..y..3e.5\%.fo2.X.*]q.5Ee.}..i..md.T....#...-...Mu...9...-+..~w5O.);..G..'.;..).....A_...M.vV..y.q......,<.3.(...._K:..XM.......w.......9..T.......?b..a-%.c;.}..>....|.,lZKCEB.t...fw|.Sw^..Y..:.J.................t._P..v..j.1.R8.R....G..W*H<(Xi........i..xcu...WM.dqM>'W..g....M.q.....+.....b'..~....>..T.~Jc....fj.X.x..9...N.w.6:..>.......&.(h..u...t._...)_k#7Za...cZ....P...Y..;.V.,..xo.....f........Y...\6...M'L._

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{9426B017-1023-450A-9B2A-8AB83D961346}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 77 x 627, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):5136
                                                                                                                                                              Entropy (8bit):7.622045262603241
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:djzuNKb3XHco17p2wolIxIx7lpskdsC/ddWNKeabJbMojpxLDTu1:VzuNKb397pwlIxKp7qs3bJb5FBTw
                                                                                                                                                              MD5:FA38AFA965141EA3F17863EE8DCCDE61
                                                                                                                                                              SHA1:2B4611E651AF7549C1AA73932B1136B561A7602F
                                                                                                                                                              SHA-256:E1CB1A0EC9BE62D5445C73AA84DF38234002A7E164EE830C9DF24997802CB5D2
                                                                                                                                                              SHA-512:A372674F5CA343321BA9C413D346070709F7685706C9C6C3DC7F61846B59253A5E6FE800DBA10AE870FD3887439B2AA106FBBB51751E92A163938A4393C43E28
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...M...s.....}8nv....PLTE.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................z`.....tRNS...................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{9980FAF6-60B0-4265-A093-1CCFFE0EF140}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:06:24], progressive, precision 8, 38x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):22203
                                                                                                                                                              Entropy (8bit):6.977175130747846
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:5q3R1VBvq3R1Flrk6Q0QPJJrR39joOVMJ25d1NkMhIwobbtAAAqYnLJZMJYZ2AC:xw6Q0WJR3FoOVMJIIlAAAqYnMJdD
                                                                                                                                                              MD5:2D3128554F6286809B2C8E99DE5FD3F6
                                                                                                                                                              SHA1:FC42CB04151D36F448093BDEFE33031A9B8D797D
                                                                                                                                                              SHA-256:14FA2D16310485AA1CE41F6D774A3D637E8CF8B03C4F72990155DF274FDB6BD9
                                                                                                                                                              SHA-512:D8531247A6E89ECABEA9C4A78F596CCE3493334EDF71AE4F7998FDDD0F80705948609C89756AB56FDFAB6D04DEC5F699A693801A772CA2EE2465BDD2CE5D2D5A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....XExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:06:24............................&.........................................................(.....................&...........*.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...H.....Go.Kxn.b..g...........%?_....O......q......7G......%%.V..8zm.].v?...jJ~._..>.......O;........o..rI.A.....n.a.........

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{99B75747-6CB2-4496-ACB4-722FA57AAF04}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 39 x 600, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2104
                                                                                                                                                              Entropy (8bit):7.252780160030615
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:2PPEOtz2P/LJtVRaqBG8qFOPvHlcEXgkuwf+j:2PZFSjJDjqFOPPlXgG+j
                                                                                                                                                              MD5:F6C596F505504044DF1E36BA5DA3F09B
                                                                                                                                                              SHA1:BCF17EC408899B822492B47E307DE638CC792447
                                                                                                                                                              SHA-256:EDBB86F160050FBF1F9860276802BAE292DBFD0BC98E3EA90D43D981E9F0C54A
                                                                                                                                                              SHA-512:E8D067A1932CED8746FE7D665EEC34EA92A98AFF3DF26FFA9DD02742DDEA3C5654124A88A649FA33DB596F96A5FC9CB2C693D03132F1C8B254ACB56DB4763BD8
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...'...X.......:....PLTE.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................{.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^..c.%i.F...m.m.f.m.m.m{&....X...9.....M.WUW.d.N.O...E$...$...)H....n....N.k..v.....v1L[w)w.}..!...Y.X.V.D.......[....;..[..;....

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{9C677D46-5ABA-4FE8-AEE4-58324DFC07A8}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 30 x 700, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1547
                                                                                                                                                              Entropy (8bit):6.4194805172468286
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:dZeDNYbS+238CTUFPA6SXG5qSacX9q73eXu0vC3dU+OB2gbwHRuZ:dykp9FzBBacXQ3uNC3n7xuZ
                                                                                                                                                              MD5:0BA36A74DFBF411FAB348404CCEC3348
                                                                                                                                                              SHA1:4C619790E517416E178161028987DF1CD3B871CC
                                                                                                                                                              SHA-256:2E7AAF26BEC32148B96442E8FFF1BD2CEF2D72630969F23B9A2ABEDB6CFEC93B
                                                                                                                                                              SHA-512:90AF53DB7C413E2ADB970AC345F73E4ED8AF626E179C929E6560118F7A9E98DC7C5FF02B2B3F6C98D397E0FE2D85F3427C6928C328872149E176FA8A99E91F54
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...............\....PLTE.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................D......bKGD....H....cmPPJCmp0712....H.s.....IDATx^.WSTA........b.0gPPP0..E.9b@L(.c.N.U>..@......;...}..B.(....$......5..XS...I....).!....D^.uE...\..5........F."o..-...m.n. .^.....q= .

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{9DA36715-74A3-479E-800A-2EE6175EE635}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:05:55], progressive, precision 8, 612x618, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):68633
                                                                                                                                                              Entropy (8bit):7.709776384921022
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:tapXpSTJDOkFGdJdBk/slsbfsw1imaapnbvD8:U2OjJr6b07m1bvD8
                                                                                                                                                              MD5:41241EE59AB7BC9EB34784E3BCE31CB4
                                                                                                                                                              SHA1:98680761A51E9199CF3C89F68B5309FBEC7EE3CB
                                                                                                                                                              SHA-256:035B26DF61855A3F36DBD30FDAB0C157C04C9E8AE2197EA4D4AEB3E82E6A4C2B
                                                                                                                                                              SHA-512:3EE331D5BCEE4AD5D3FC9661D4AB4053F7D351591A094334F963C33C9D0E32CCCABE9334AD7C308108CE99617E064FE848DCD469ACD8D83FBE5C4452DE523D8F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:05:55.............................d...........j...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?../$.W:SZ./...9.....-...u......r.....].c...@W_.7...+......v.+PD.I..-<1.pDn-\.....p.$....0.}V....\..>.~..XN.o..l(E....ik..o.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{9F099921-4424-46FD-BDF1-83D74027FBCB}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 88 x 574, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):19920
                                                                                                                                                              Entropy (8bit):7.987696084459766
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:DRSgtAxJx7bzvAsVSqQElOT4uHmpmvNYT9aPU+QtsC2LgfIqJZnbeyRB:DsgaN7bzvAsVdK4uGQFUZ6bU/p3
                                                                                                                                                              MD5:1BDAD9B3B6DE549162F9567697389E1C
                                                                                                                                                              SHA1:5D9C09159F07A3A9BDCC6C4B9BD9CB72D0184E6F
                                                                                                                                                              SHA-256:0908A4CFA23F93011176D47F45843E9CA2973030421996E8E27484781F54B0EC
                                                                                                                                                              SHA-512:475040779AC247BB5C3E11862FB55FBDDFA12D759EE86A33E11BC1F3B656D6CD0F9B25146C0113E43E1D8001D8867D3BC3BF7E6FE21F3A0016CB1F8B70B7A15A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...X...>......y=h....PLTE..................................t........iw..............................................._n|...Tds...ky......................................................p~.....................................................dr.................v.............................................n{.......ap}..........x.....z...................u......................|..Vfu............r.....w........................................~...................Zjx...................................Yiw............w..|....................Xgv{.....y...........................jx..............\lz.........}..z.....t..[ky........u..y.....gu................................{..........}.....u....................~...........y....r.....bKGD....H....cmPPJCmp0712....H.s...JfIDATx^...\.W./.}....Sy...(..4....D.-.....H...% .$"D.Qr.......`..;...6...N......s...^...L.....Y{.GQU`..~...j....{...-Ax.K..&.....F..I\i..

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{9FE08FC2-A344-4998-B623-0429A0E08AFE}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 105x441, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2268
                                                                                                                                                              Entropy (8bit):7.384274251000273
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:N9YMn9H5gXlM26vroVXWxyNnl1LmLR+rn4FOeewGhDbby:/h9SlMdgm09ll8R2/rby
                                                                                                                                                              MD5:09A7AE94AA8E517298A9618A13D6E0E2
                                                                                                                                                              SHA1:FA5181A7414BA32F816BF0C4278EC20C615E8B1A
                                                                                                                                                              SHA-256:3C68C7EE798E62A4A99C740153F3980D7DF029605C843410942C7F85E794823B
                                                                                                                                                              SHA-512:074E9A2BE2039D0AFEAD360157550B934FABD0CB86B5AF476C1FBC885EE60331F5A68EAF70BF76E23C8248A20FB900346839F4AA8892370B5889E64948DCC6E2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........i..".......................................3......................!.A..1Q."q.2BRa.b...#$................................... .......................!12AqQ.............?..D.z.4....;.....7...3.t<!..d.O.....+O+.;.z6.4cz7E.........U.Z)-..@..y...........}(W...<.xv/...5.ew......yN....n.Tk.Tm.Ty.vA=...T..U....h...e.8.5%....'......e^......L.g.$.~e..O.._...... .F`.....xnL.<.......]jfv...}..\G..c.......-%...#.C.|.].`..^..W..c..B..5D.QSTaZ.5A=....BU..z%.4.h.6..=..U...W.$..l...7.:...........IPQT_...~..i..x....~.l.|.n.J..TV.21.Tg.....................j.z!+.-............"j.j...)*..TT...."....T.Tc.**j..............j.z!*.h...&.&.&..e.%..TksTW%G.?".l+$..c._9..[x...TU..........i~X..#'.qm?ttO.....}*.i...q.....9..r..?..W..d.w...f;..q...tZh..0.....2.......OD%Q-.......$......56.K.O...y._..*_C.k..p9.p..O..vu...'........0v

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{A3577F8B-7EAF-4386-A9BD-F4FDBD07227A}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):52945
                                                                                                                                                              Entropy (8bit):7.6490972666456765
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:cjvqR0XvFaGCTJffi0tgybmWDoTw71kHUAnjvawrlp2+NUO8dWSNl3PF2PjK/q09:cyRffflgybmWoTw1UUADHUbU21MjpAD
                                                                                                                                                              MD5:AD003F032F32FAC4672D4CE237FA5C5B
                                                                                                                                                              SHA1:AE234931B452F0D649D91291763B919CF350EA49
                                                                                                                                                              SHA-256:ADB1EBBE18D6CD8FF08AA9BF5C83CDB83BF9AA179698E34E93DBCDDE12F04D32
                                                                                                                                                              SHA-512:ECA25FA657ECE3A66D3E650628E0F65D3BADD38864C028AB6553950A1A66D7D55482C85E9E565573E9E5AAFA91C2D53235971C644A266D41EB69F8E72E3A843B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQ..aq....".....2....BR#r.b3$...C.Sc%...s5E......................!1.A..Q.aq"...2...#...B...Rb3..$..CSr...6............?......y_N.e.H7?........W..w....k|...S..d.4.>.RW5z.$.i.)V.O....>o...c..*&1.D..O..".ufbb..1...t..u=..K...m...~.....F..-.fb:i..=f..C.w.[{..~.7k....;..:..3....4.....$..m]...}....~q...9T.#..7.~..8...q.N;c..ffo.w...W..d........../t_........lWJE..).>..v;:=....Rrw#.m.n.n...E...vm.J}2N*..|.4...80.#..e....t.J..ZQ.x|g/....F..e....k+vK...M..W.X.e.L..~...j.....kz....=...n:O.:..[.L,.+R...Y..zKNI....,..{e..U.'...}.......|..t.]...~...b4......_.i..../.......m...a..n...v.j.?..Rc.$G|.31..#..$?.........h.w....-... .a.%z..u......u.A....Fm..J.......G..[...w.....:....w/.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{A3B476F8-54DB-4A97-BFA0-44B6D25ADE5C}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 814x105, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12654
                                                                                                                                                              Entropy (8bit):7.745439197485533
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:JheN2cq6MLu6MLGu54cHeNzhcmhcDu53eNE3UPkhrxvu:Ji2Wix7fzVsbE3Zm
                                                                                                                                                              MD5:4BCCCDBB4273ECEBE216C84930A8D0B2
                                                                                                                                                              SHA1:FFBF617787E27BC94D9BAF89F2FE34A2BD42794B
                                                                                                                                                              SHA-256:474F9A8C25D5E21192315397EA995B1E11E2C1608157C6E0277688091BFD136A
                                                                                                                                                              SHA-512:DAD73A8C0E293B88685C0C71EF15E0DC95EE39B7FC9F849DE5D634173FD9FA0AF0AA96742D9E94BE03556AA4A817D5001C95A6736EAD5D5DF03661876785EB74
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....C....................................................................C.......................................................................i..............................................E.....................U....V...f..ASTc.......de.1Qq...!Rb....Ca."r.................................B....................b....Ra.....!Qc.....AS.1U.."C...2Bq...$#3%&.............?......3.....~......:..g..s"......:..g..s"..ic..Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. ..0...Q_..X..V5E~..c..X...@u...cTW...0...Q_..;.m.....@w...Q.+....*.4W...lUFh....v..._..wn...dW....y._..v..E~...*...@wn...dW....y._...v..U..@wn...d..{`;.|U.2g...*.3...:.0?ViN.z.@w...4.M.:m..`~..i7...q...I....J.`l...W..n..PQTiB...6....+..sj.*."...6....+..WA...x..A........(.N6`..AD.q.....'S...t.Q:.l.......f.]..N..0.. .u8..A........_W..Y...}.C...~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~.v..?U..^.r..}..Bep

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{A64169E6-C8D0-4998-991C-212A4D4F39CE}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 177 x 123, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):65589
                                                                                                                                                              Entropy (8bit):7.960181939300061
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:2Hlrjw3xL//DPgff+9j6yPWvHMHjkbfnwHO3AW3GL:2H2zDUU+yPVHITwNfL
                                                                                                                                                              MD5:8B48DA9F89264D14B83FF9969F869577
                                                                                                                                                              SHA1:E1BD58E2D80FEEF56DC514F3F0B3AB9669F22F95
                                                                                                                                                              SHA-256:62AD3C277E54F03F1ADB44062407346F789E63859B7AFABFD64BE6AF5E9F66EC
                                                                                                                                                              SHA-512:03B783EC968DF3F648504D068D64DD1AE110E28110FE5B3401C9D04F44897DBE0CBB5680D42CA4C665FA94A6CED4B559106EB3C06C9BF2C5B14951ECBFFAC8AE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR.......{.....;Za.....sBIT....|.d.....pHYs...........~.....tEXtSoftware.Macromedia Fireworks 8.h.x....tEXtCreation Time.05/15/06.8.p....prVWx..Y=.+I....t.y...,^vv....;. "|. .i7.....$.2g..']pH@p..]b....H.H.......d'@ B...U.xm..3{3k?..5n.._}U...3......~..>...g.....f..t...t:...p>..Si..d:..k:.Lf..t6.K.i....d<...x.8\.8.+lc...)i.$.r.....x.t.BG.R.cm.c...p.:&.6.4..K.......^...~b].0....oBYv..u.'.=.K.Q.g)6.....4.!.M......4.=....G.%.Sr........nxC.F..t.U........1...J.t..eQ....".... |...81.$D.!.>...........$...^.vY..EY8tb..'.P.g#O....S*..0'.V....x.W..........k.......s.C.S...J%.iVb..].........3....j.}*.z....+.s..@..K.....\x.C..e.Qq.....;N.....;....,....^.*..$F..{G...8.#....8'..&....8..5.....3(P._....S......|".....u.cr....+a-....&V..x...iI-<|a.{E.c.X.......?..&.C....'........(.x....>...M.?.9..#X......l...0...Z.F..<.z.0}Q..Z1..........?h..`E$K.2o.A*c^.......*..D..uL=.}.#*0.. M!.A.C......|_..(.Y........!E... .O...`;....M+..x.u~g...q>...N."D^..K..x..D.`.!.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{A693132E-C4A1-4336-B551-A711C41224C1}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:44:07], progressive, precision 8, 611x163, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):36740
                                                                                                                                                              Entropy (8bit):7.48266872907324
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:3nwDxjTvoE0Rjwit4rjucDILWg7/Da0JgGQ8e1S8SA/Khos0:SxjTmZw7nucDILj77a0JgGQvScb
                                                                                                                                                              MD5:9C205C8D770516C5AA70D31B2CA00AF3
                                                                                                                                                              SHA1:9A1002F0CF7F92F1BE2BB25BAD61CEBFAC282482
                                                                                                                                                              SHA-256:E111F96490755C7D71E87C88ACAEA38AFE55BB865B1A14A83C5BD239648D5E2C
                                                                                                                                                              SHA-512:A3E105208B32831265428572B0937DD3C17B793D8611B2DA8D4939F1BEC6050999D375E3F6B87D53AD49DFA0EAE737B0141D37597AA42116C310761973D4A134
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:44:07............................c.........................................................(.....................&...........n.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d................................................................................................................................................."...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..o...4.gP.~.c...K{...V.=...].<.........vS.........s....(.t......X......kk7....~-...yF}^c.Z.\.G./.?t...>....:.>......./.ib..).

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{AAF4B5AF-5347-442F-9C2A-296E730EB76D}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12824
                                                                                                                                                              Entropy (8bit):7.974776104184905
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                                                                                                                                                              MD5:2628353534C5AD86CBFE57B6616D46DD
                                                                                                                                                              SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                                                                                                                                                              SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                                                                                                                                                              SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{AD333FCA-6B11-40EB-B926-1B5639610BC5}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:11:38], progressive, precision 8, 577x757, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):84097
                                                                                                                                                              Entropy (8bit):7.78862495530604
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:cgHTEuD99rHwA5MSadIV2MApVmfJkAKOQ/Z1I7ngpDDyHfKFVITrU:HHjXidIhApV88/jIEmrU
                                                                                                                                                              MD5:37EED97290E8ECB46A576C84F0810568
                                                                                                                                                              SHA1:18D9FACB4CFA3CBF63B882CABCF30B203EDF4126
                                                                                                                                                              SHA-256:140DD943D0F0CFE6AAA98470B7D1A7CB62CA02CB1D8F522DD2AC77433232EF41
                                                                                                                                                              SHA-512:E0F57314C136211B8253EB2AC0093DED82198E7170D4F97C40D82FD4EC4123D2AAFE3EB4EBC3E7523C4DF4D77619408773871BDE15B6DC6C4049C71D5B9D4222
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....hExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:11:38.............................A.......................................................&.(.................................2.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................z.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....b.xH......T..I...S.q.~..../s.R.x.....8.a..vE.5...-.G.A.4...._......$K..d.@NC.q....J.....>e".I.%...I0).R.I$........M3.F .

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{B1E5D05C-88AD-49C0-9DF0-78652A0E9D0C}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):179460
                                                                                                                                                              Entropy (8bit):7.979020171518325
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:oiKXvL7lv0am/R1vrdH+9dK6zPQ6bbnGDpcGGDNMIOIMAT8q9Vc02Q57S4A+vMFz:+vlvC/HvgA6fGqGGJlO1qZ71W6CzDn
                                                                                                                                                              MD5:4E131DBFEC5C2462273CA7B35675B9D9
                                                                                                                                                              SHA1:CA037F444D819A118AC37D7AA3782B9BF94C1616
                                                                                                                                                              SHA-256:2A4A3530D652E227DDD5ADC096A95F6034718F7C380B07DB622022D768815059
                                                                                                                                                              SHA-512:C333ECEB1439D0238BF44FB7896E62DBA4C645B70413AA0F99C1F10E8DCD20C2EEE5C83F2E9DDE9A2494C85A6D8D13CFFFC4160E2F598E17867015F5244D656A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!.1AQ.aq...".....2Rr..Bb..#34.....CSs.$5c.t....%.Dd.6.T..u.U....E.7w........................!.1A.Qaq......2."r.3....BRb.#4......CsSc...$.5..%.DT.t67d..Uu...'............?..c.......p..z..i.....z......kj........F>f......3N...M....RM.&..-.~.Q..'.....q.a..w...-~......g.{..&.......V.n.D....>FS!n.....@..)...W..q..Wr{..J.gf.{.M$.P@m.,..9..&m.D...w.._...-.O........s.....h.k~......(.K...V..l.-...+.9.k......*......#.p#.O..9M..mF...C.......7+.AI....4vw.;..H......e..Q.u[.eUK.....z.....[.Kt...s..Lf.4..l{.....sh.............=..;..iqkj.m.a...NH......v..H..$..q.y......c...U[Mcf.......+...S-...^....4..T..YtL.x.v.;.....<...Ik|B.$.s8......3.+.8.l.. h.:....%B..W..I.QRS..,*x.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{B40BAF73-D0AF-4AA6-B3A1-F6D19DD29624}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 262x277, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3555
                                                                                                                                                              Entropy (8bit):7.686253071499049
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:/h3JeYCQV5Hn++9HBdAjU78S/mjLLwqnqahJD:53Je8b+EBdAjm8S/mjLLRnphJD
                                                                                                                                                              MD5:8A5444524F467A45A5A10245F89C855A
                                                                                                                                                              SHA1:ACE68D567B02B68275E0345C86DB1139C0EC1386
                                                                                                                                                              SHA-256:7D2B01F17354D9237A6AB99D5B9AFDF0E1CC43687125848B0C2DEDFB44CE3843
                                                                                                                                                              SHA-512:8151B447B60D110C32EC1EF286B941FFC09B99140F41BBACF5A1650A385FF4D13C0DDB2878E9A470FC7CFCC95A1AB6E44F6DE72562B0FFE093DC8A3C3C7FCC14
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222...........".......................................2........................!1AQ.a."2q.B..#R...3C................................ .......................!1.AQBq............?........)&vD.)3Hn*..X+....r...tmL.k..(.E...R. .Z..&...,fJ...!...6..S\t3.=...g&..Bqe.)_U.....1......-..fl.................J...u.i.mU..K..v.w.0O..E.h..D~K.(..9.,8..E.}.............i.\.....t."v..q..C............<..|3.........................*Q..../c.....f.}8....D..|k..Z......0..~..c..e..m(...|.c..'.5.5............==bx.5x.8...T;....=.--.pc...I;.V.m..,(....}...NH.ho....Q..U.E$.~...w.t>.S\....'f.{.+.g._.t....;>.....P...........-..G.h..2...J.% !.E97Ir.D..N....j...oE._...._...".?.......#".S.........Q.Tc.I..*I..k.......=$.........sk1Jp.\K.....F.3.Q..q..J....N..[l.&....OR4bB|..2ul....J...B.$&H..9#j.f.n./........?R~....B.I.@..........m

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{B62B2980-AB7E-4BC1-A1B7-2444055E9860}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:19:29], progressive, precision 8, 221x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):24268
                                                                                                                                                              Entropy (8bit):6.946124661664625
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:d2wiieoHTRh5a1HAteZCWOZIM+L7WhNjYn:8wHFHJ+/OZIKhNO
                                                                                                                                                              MD5:3CD906D179F59DDFA112510C7E996351
                                                                                                                                                              SHA1:48CDB3685606EDD79D5BCDF0D7267B8B1CCBD5A8
                                                                                                                                                              SHA-256:1591FD26E7FFF5BE97431D0ED3D0ADE5CFC5FA74E3D7EC282FD242160CE68C1F
                                                                                                                                                              SHA-512:2048CBA13AF532FF2BCC7B8B40541993234BD1A8AB6DE47B889AF3F3E4571F9C5A22996D0B1C16DD6603233F6066A1A2A97C16A6020BEDD0826B83BAD0075512
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:19:29.....................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................$.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....)......[]t.\Z..g......A....&D.$LH._..X..Xl...`....cZ.X.........>......f.Z.X...]..~L.S..@..I$..I.IO.....x...s.g.[f.h{9..

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{BCCF9F9E-47E5-4AD6-BF29-CC1EE6405D43}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 276x139, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4819
                                                                                                                                                              Entropy (8bit):7.874649683222419
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:/hnQiz+ET2/hDi+tv34VtpWfowTHgegb6hhLT1NTS:5nQ6TAhLtvIzMvbi6hhF0
                                                                                                                                                              MD5:5D6C1F361BC04403555BE945E28E53FC
                                                                                                                                                              SHA1:00C254F7B3BC0289590C2BBDBB39C8EC2E2B2821
                                                                                                                                                              SHA-256:131D637CDC5D0B094FB9FAD17F4D2A1ACE0D03613588155AACAA2D1CB4E16DA9
                                                                                                                                                              SHA-512:34D2C0929FCC3CC10D0A2121BD55BFA9A07062C2A7B8F101071164C946895DBCB2777641E79DE4193D57A3F0778DD4F1351FAF333B7E4B4DBE31A32DD69C51F9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222...........".......................................<........................!1..AQaq"...2B...#Rb..r..$3CS.cs..................................................!1A............?.............u....p.p($.Y...9,j...V.*..S86yh.G.#m.5..9...6Y.."C.R:.[..-.7U3c:..].;.....f.?%..<T...&F.Lh.N...m]..x.D.g<B.....k..S........>j.K....#U..Z....<e.:..8....o..xq.[..4v..U..y...k... k....A#..A...pn.jJ.I.7:..{.b..ns.t,...8.Td.I....m.I.5Z.).-.. ]..X.Do%.....?..4jV.`llt.E...5...u.|..\F.=.F.r<...5dV....xc.%..&...4,...f...3..H.<......eQ...P.J....7...lLc..?..-.fR..7.#.6.......}:.]'.ny..........e;u.Y..$0...i..-....f..9(....}..T,.Inb...+=Cca7....WULA1@.s...4uY5.N.f.c..].ks.....3v..~..k..m)...f gNE`S......#.....Z..6.uc.m...#k.s.f*.l.$6..?..xC.Cm.`...N2..&H...._.&.E...[....f.Z./...!.a{K..#.V.5..v.B....1...9..B.&....%s.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{C231A95A-3A60-40CF-8CDF-052959A9A928}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41893
                                                                                                                                                              Entropy (8bit):7.52654558351485
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:pZvVQkUbOHxx3pvVmO5rsP5gUdXwFMuv53knzyncaXgRDqPU:pZkijV5wScXwFMYknzucaXgRyU
                                                                                                                                                              MD5:F25427EFECFEE786D5A9F630726DD140
                                                                                                                                                              SHA1:BC612A86FF985AB569ED1A1EA5FFC4FDB18FC605
                                                                                                                                                              SHA-256:5A36960DF32817E8426BD40A88F88B04FB55B84BAEF60F1E71E0872217FDB134
                                                                                                                                                              SHA-512:B102F34385196D630F198667E874F25ADBC737426FDAE0747EC799B33632E5DC92999C7C715DC84D904342738930267AB1709870BDAA842243E4C283FE5E1554
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................!.1AQ....aq......"......2...Xx..9BRr#.b3$..&..g.8....%F'G.(H.Ss..D5E..v..W..Cc.deu..7w.h.).....................!.1....A..Qaq...Ttu.6..."R..5...2B..S....bcs.Dd%&r3C...#$...Ue.............?..R...%.R...t.MQ*.l...v...V]..n...Zw....M....4..F.&&bb0.:]l......ay.r<..3.l.Q^.........I54.N2.8..2s...w..r6.......[1Zh....O...9..>...B......x]...r.\.\..v..~....y.QT.3.......=....r..}.l.....o;....M..C1....w)...+o1f.]...MoA.E..s5..i.\....miGsy..m\.Zj....I'YU.\tU6La5v.>.K..m.]1.......k..0....</5v.V7lY.e.vV.+./[....f..u{....s.}.Rb.Z.....Y.6]..m....V.\...Mr.=r...K...l..%..m^.......X.(..fG..[F*ly.jL.a4..vs..o.e..q.9km..w1.yg.....r_.*h.n..5i.-.{Y.l...<...'Or.s..Z....../JP.....\FV.S..............m

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{C2FC20CB-1610-43F2-9442-46D0C5700115}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):39010
                                                                                                                                                              Entropy (8bit):7.362726513389497
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:6tCjwO+E+KW0ZtOgepcoWW4pAWQ6/KWcR474HOAZaDfK:68j+E+KW0HOgep/72/NKWcRNefK
                                                                                                                                                              MD5:9700DE02720CDB5A45EDE51F1A4647EC
                                                                                                                                                              SHA1:CF72A73E1181719B1CC45C2FE0A6B619081E115E
                                                                                                                                                              SHA-256:7E6A7714A69688D9FFDF16AA942B66064A0C77FCD9B3E469F89730B4B9290C3E
                                                                                                                                                              SHA-512:5438921467D62376472007B9EBF3C35C9D9FE3EDE04D99A990129332D53EBC8EE2555C0319A4F7C0DF63516F29CEDF2171D8B6DC34C9FCD075C2CA41EB728660
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!1..A...Qaq..".......2BR#...b%&6..'w.r.3f7W8.s5EUeF.g....CS$4.Vv..Tdt..G..(c..u.Hhx.......................!1.AQa..2.q....".s...3.4BRr.#......b.$c............?........uf.....t...;..[...W.h.....-.k.f..i.u..KQ..b.F...rM%/.8n.S..=9.....G$O;.f.}L..N..U._i.[.X...3.~....S.~..+t$...c.5......{..X/..#.G...}s....6......^....o~.$.\WA?...^*w[O.~..6..~....a....~..:..0.......{O...|.s.u._w.........i...........{K...._.?.../{.....A..8....<g.iu..<..................X......|]v....D..9.k.w.|-IF.Tv.-.&.........."'.4.b....z.._.Z.....G...u.xyt./_.q..m>..S.V.Xdc.bw.T.W......g..........}s.._..?....U]_.......`......>.|'.~xH....,...?........?.q....o../..R..;...Y.G....A"?......?.<..1...w..o.M.........tco.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{C3773F91-E42B-4490-A544-B34709940447}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):32656
                                                                                                                                                              Entropy (8bit):3.9517299510231485
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                                                                                                                                                              MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                                                                                                                                                              SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                                                                                                                                                              SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                                                                                                                                                              SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{C8D5BF0D-68EB-45A6-9E15-048CF571B661}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:15:20], progressive, precision 8, 604x784, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):140755
                                                                                                                                                              Entropy (8bit):7.9013245181576695
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:i/aDiblRsFcOco8dofE5Zx1+NQI8Wh9aiOe5NTO:mnbM+TxaAi98W3aiOwTO
                                                                                                                                                              MD5:CC087700C07D674D69AFDFDA0FA9825C
                                                                                                                                                              SHA1:F11113DF69DACDB255C6CBCFB29C1D1CCE40B346
                                                                                                                                                              SHA-256:A7FA7F092EFF43030A56342C39A765F8D5CC48C7DB815DDFC8C1E5EC40117FAE
                                                                                                                                                              SHA-512:843202D975EFA91E73287052A893584B6E5AE601F91612B56539AA2F73D1AD3F997FCAD1E711E0F483A2E91D46D9643D0B026B43F4E94116A5D2FB6551536034
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:15:20.............................\.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................{.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.......J...\O.,......../$..........OE.m.o......T....Z..l.g.-....m.?...Y....3......"....].j.X.k.S.k.....4..R....{....?F.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{C9FD3CD9-07EF-48E7-ABDE-57BEACC03BDB}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:27:10], progressive, precision 8, 102x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):52912
                                                                                                                                                              Entropy (8bit):7.679147474806877
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:DB/nIviNJD9C8kfJj6TkVr4q24FsUpjPc021si:DdnIvi3D9C8Cl6Dq24ayPCz
                                                                                                                                                              MD5:1122BF4C2A42B4FA7F29D3C94954A7C9
                                                                                                                                                              SHA1:3750077A830FE21735A43ABD35C63BA9A4D4B0DE
                                                                                                                                                              SHA-256:423B0DD1A93B391D15B1DC8D8757C3BF5725FF2E7A59E6E3140033E2876B67F6
                                                                                                                                                              SHA-512:4626EFE2EDED2361D6296B57F994DC434CC9D02357A8A6A67D84A544FB8A1CFE0005EA98F846AB963BED7F2B6CE96BC9181182C9459843A52A98D3A731A4FE73
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:27:10............................f.........................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....]+\.9.9.P.d..Z.?~>.-...]6=....*.......S.9G...b<$..Z..........>.v.o:.o%.e...z.F`...[.wo..z.....k..E...5....G..7.......c2..

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{CA6AA51C-0963-4C7A-9FDB-3E13CC5F21F8}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:18:09], progressive, precision 8, 164x641, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):27862
                                                                                                                                                              Entropy (8bit):7.238903610770013
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:LTawAZvhbrXzDc6LERLQ/b5vXOl6pXQ/wD5OUMrdRUUhCplQg0ESSz:6wm/vT/b4wxoqbdUhWnSs
                                                                                                                                                              MD5:E62F2908FA5F7189ED8EEBD413928DEE
                                                                                                                                                              SHA1:CA249B4A70924B73BDA52972E9C735AEC35A0C5D
                                                                                                                                                              SHA-256:20ABE389C885E42B6EBE9E902976229BB6FD63C8C34CB61AA70B8B746209F90A
                                                                                                                                                              SHA-512:EE8D1821A918BE8714F431895E7223D08036E88A4FDB9A5485EFF246640EE969A69A8AA4E2E9DDC35BA75FB6D4E95092A286E90B477BD6998C313639C2C31F25
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:18:09......................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................!.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..P.v..+..n(a..Q..S\6....Y....D......} w#.b..]l.5.RU..k...... ]$.$.........f........?.z@2uU...7....?..|.Q..I.&.. ......"T4)wdH.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{CECB9BC4-CDD5-49A8-BA42-6789E73CB1D1}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:18:09], progressive, precision 8, 164x641, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):27862
                                                                                                                                                              Entropy (8bit):7.238903610770013
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:LTawAZvhbrXzDc6LERLQ/b5vXOl6pXQ/wD5OUMrdRUUhCplQg0ESSz:6wm/vT/b4wxoqbdUhWnSs
                                                                                                                                                              MD5:E62F2908FA5F7189ED8EEBD413928DEE
                                                                                                                                                              SHA1:CA249B4A70924B73BDA52972E9C735AEC35A0C5D
                                                                                                                                                              SHA-256:20ABE389C885E42B6EBE9E902976229BB6FD63C8C34CB61AA70B8B746209F90A
                                                                                                                                                              SHA-512:EE8D1821A918BE8714F431895E7223D08036E88A4FDB9A5485EFF246640EE969A69A8AA4E2E9DDC35BA75FB6D4E95092A286E90B477BD6998C313639C2C31F25
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:18:09......................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................!.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..P.v..+..n(a..Q..S\6....Y....D......} w#.b..]l.5.RU..k...... ]$.$.........f........?.z@2uU...7....?..|.Q..I.&.. ......"T4)wdH.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{D3236286-147D-4F44-B7CC-C3D1E2F5882D}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):14177
                                                                                                                                                              Entropy (8bit):5.705782002886174
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:EbgGcV/hlvpfal7rgYa8S7auAxwfuSTmCSNoFQ6NO7L:EbgGcVnpwimnd38FdQL
                                                                                                                                                              MD5:7CDCE7EEBF795998DA6CAC11D363291C
                                                                                                                                                              SHA1:183B4CC25B50A80D3EC7CCE4BF445BCFBAA6F224
                                                                                                                                                              SHA-256:DE35AF949D4F83E97EE22F817AFE2531CC4B59FF9EE6026DCA7ECEBC5CF2737F
                                                                                                                                                              SHA-512:560FB15A9C12758D11BB40B742A6EAD755F15AD10D6C5DEBA67F7BC8A2AE67C860831914CBCBCDED9E6B2D1D5F26A636B9BCEF178151F70B4D027316F94F27E1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!.1..A....Qa".q..2.....&...B%6.'..R#3.$E.r457bS.DUFV.Wg(.......................1...3.Q..2Rr....s.4.!Aq.S.aC5B$%............?...n.Liq.}.{#....3/gg.1.M +..~3...q..+=..:.g.i1;P)7.....q..n.s"p...wx........v.t.f;..L/..~....y.r[.r.....n.n3..6i..g..}../........3..x.L.i?We..l.......~..<.;..6..o.....N.t.o6.l..~.......<...m.V...Q.7k.u./wq.t..;.I...}..{...>.L..3m..a....yd......6~.f..~Y..}+..<.[w..'-..?.v.7...v.u..4.......1];..u.MO.......s..p..ms.'.O-o...O......m.k.e....)t....i>..E|....,iOyD|.{......g.n...cu....=..........h.\.Q:?g/?.I.3._...t...d.n.0.%y....S.Q....S.&K.w..&wY<....%.g.v.....$y..#,i;.=...t...I6..yO..o.d..w\k...~......)..rK.......].u....N....e.s..kU.u..'}

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{D6369C1A-D29C-48F6-A8E4-76426007762E}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):109698
                                                                                                                                                              Entropy (8bit):7.954100577911302
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:rDlmvIWr0aRtNCfShCWBxyCHMlcVG0Ezy4FR:rDliIfot8ahCWBcCHDVwR
                                                                                                                                                              MD5:8D804A60E86627383BED6280ED62F1CF
                                                                                                                                                              SHA1:E23FF14B10AD0762DD67FBA3CD6EFC85647C0384
                                                                                                                                                              SHA-256:494547E566FB7A63DD429EB0699FE41AA8998F8EA2F758D813FE3D56C3075719
                                                                                                                                                              SHA-512:0FB19F3D00159F2748C3A54E952E551B9FEA6910D67A54DECA8D099992E50383EADB92768FF1F75CFFAE82A7A157B1E0F77A2F0BE7EC64FD2324304FDCA46577
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...............................................................................................!"#.123..AQB$..aq.RCS...b..c4%..rs..D&....5E6'..TdUte...u.....FV...7.......................!"..1A2B..QaqR.#.br3.........C%...$5.....c4U..Eeu&SsD.6T..................?.....O.C.....^..R<A.g...[....3.....r.0.....nX.S....}...[.?Z.....A.?..~~I..rY|N.o...9......!...o7r../-.y...'5.3.U.s".-.0.1......SS...&.Q.j.*.$m.e..:x....`}...EP.?.7..~G(so.......O.....z.N..<....~^a.e...........p9.?<._..|......~.<@.D.9..G..?.?z.y?z.C.U.w..[.,..A.+........s......g...G.^....pz.xY.....d8.y.X...P..O(A.O..~:._.......<...o..4s..^.^b..x......_a.....|{c...:..X.....}.._...[?..NK.c...}.<......H.G....+x.Z..|....n...o....`.nk.#.%x......-|...|7......N!=././..w.8x.".8....'x........w...,>....j[w8a..}..lS..?.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{D9378DA5-2EE5-437D-B88C-672C8A707551}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:08:07], baseline, precision 8, 595x450, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):59832
                                                                                                                                                              Entropy (8bit):7.308211468398169
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:HS9SYFtN0+CRa9mfJy4zBAiIJhzrkHDV2hJK:yAmta+Tyy4zBIJW5WK
                                                                                                                                                              MD5:DCDD543A4E0BA2C1909BA095D46FFBCB
                                                                                                                                                              SHA1:B86C89537138FE07255354202D3EAD0B53B3C54D
                                                                                                                                                              SHA-256:28F334B77068F71F5F92A95695433B950610204A0E5580CE567DB8FAD4993ECB
                                                                                                                                                              SHA-512:5408C3259B7F3288A4BEB04342799AD5FE3A6F0EC7E92353B29B7E7E538DFA9903B39637226919E0421BC422635D25F5F8069DC7441864DC03E1B909BF5C2C84
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....fExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:08:07.............................S.......................................................&.(.................................0.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................y...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?......;R~+'....xh..~.n-}.......Te................^B..IU_....._...S......h.......!....9...A}6V=J......C..c.....Ug.Wh......

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{DA5AA851-E2AE-4E27-B6D6-7BEA9380006A}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 60 x 336, 4-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):347
                                                                                                                                                              Entropy (8bit):6.85024426015615
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:6v/lhPtnlx/QulkWNY2V18A6Akp7eee1VDjMHCyLezyKUX5Gp:6v/7RrIubiA6AkpNhiyKe+
                                                                                                                                                              MD5:78762C169F8B104CB57DFF5A1669D2DF
                                                                                                                                                              SHA1:9638B71B584CD636834016A635ABF8D9C0887711
                                                                                                                                                              SHA-256:E64FDCD0B108737D8B8F7B677029F924031D6BBAA50585D9C3DEF7C7E92ECAF2
                                                                                                                                                              SHA-512:5ED899AAF73B72DEC32E171FFA112382667D5BF3FBA98C92E313E66C0A6975EA97068F4CD32B62283F18DBD5345C11E3610F7EEAC2F2DE71FC44593180B9CEAC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...<...P.............PLTE......................=l......bKGD....H....cmPPJCmp0712....Om......IDATh......@..aI...B..C..l...^.%.`....>.]..|0.....a...hb...0......q.......p"....;...K..x=...p...y.yy~J....|...\.......y..X.......'...>1...Ky..f....&........N`..f0..b...3.......`Z.3..3.....o.......4.&........SV...4.....IEND.B`.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{E1963D26-08DC-4321-9734-CE54DD1F2087}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 176 x 513, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):11043
                                                                                                                                                              Entropy (8bit):7.96811228801767
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:YyroOCsBI9pkCFsHHX2RE6VOlPuIqmBtJNBfAr+ADP1IATaNeTyZ4GF+WQQ6Qwq2:BUOCsB2kCGH32RiPDtDBfArPDP1I/eyM
                                                                                                                                                              MD5:8E9AB9C28B155A66BC5C0DA5E2A4EFB5
                                                                                                                                                              SHA1:972E61F162D48F1CEE21963ECBB2FE439105DB55
                                                                                                                                                              SHA-256:B243A24FA13BC8523450E22F408F9EFF15301C938F8CA52A57018B58CE6785DE
                                                                                                                                                              SHA-512:12062D69E676B3B34AFCEF25AC17B40294282D5BAB6C0110680293D7CC96EC17EBCFE104C284E64A30EE3C483E319E9C37C03F6EE82C79632180E45C7A684E8C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR..............`....`PLTE............................................................................................... .......bKGD....H....cmPPJCmp0712....H.s...*YIDATx^.]...,.N.8.i......0..e..y.......8.6....Fo.........=...F..._..........O..{..............3.|.L.|.............>.....v..n.1J...k...."....7........J._.5LQ`..k...._Z.W.x:..k...g..._.....u<.Q{...1...q6.cs...l............30.g...< W...a.5..>O....9}..c..........s|I.).>.fo4.<q......>...c.:.u..co.#.7,.O..G./.K.|..q.p...(.(....iH.......m..+.7...../..{W.l....b....?.`^.q.9L&.>.hN2`1..m...]$.0J....rBy......{.._...G....;.r.Q..;..,...9..F...t;.+..2.Ub......V...8.k..5.........'[..s.H..).......%j._.&.....BN..V..q...T...#..........0.E&.o7....$..m..8g.f._$..k.8...5......HgQ...L..\.........)B.I.r.(..8.a..$N.9.=..o..Q..(.e.a..O.....c.= .......$0..X.S,..(p......$..l.c.I...=."......g....^..#~,&.a9iK..ZNE`...pFJ.@Wd?.<..Bt.E.......e...i.%d...}.!..B......9.........B}.....5...;..hL.D.....4z.....|.)

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{E334661C-06B3-4828-AB89-1DB0C6605A75}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):47294
                                                                                                                                                              Entropy (8bit):7.497888607667405
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:aQ10VrIBdBvDpQrQ7P9/FUOLG2vTSeG9lkCsMKzXeMBk3CBp:aC0JIBL+QsOLG2+ZAC1KqM2I
                                                                                                                                                              MD5:7A450E086AD14BA7D89BA5DB3D3AE6C7
                                                                                                                                                              SHA1:E7AEAFCFCE476390E18C19456BDF6529D863D518
                                                                                                                                                              SHA-256:BDD997068701ED3A00A224EB694B003C01AC69B857FE7B4147D6C34875B1632B
                                                                                                                                                              SHA-512:9B6D50A6CDB6081DA107A2CDDB1BD2811A5764994C8E3F67D56CA81084BE0D068C27435154E867199F38688EA65E8DE02A56DCAC47D0F5E55F0FBB6598814938
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..A..Qa"..q..2.......B#...R%.r...$&b...3Ss.4dU6F.cE..'GC..t..5eufW......................!.1..AQ.aq..".....2BR......r.#3.d...b..Ccs.t......$4T...SD%5Ue&Vf............?..M.7(..).:.a.q.......>..[:O...afQ.uCO..U.....go.l..p..YqVklQ.{i.w&.]Z.\+JQw._.n.'.h..,.bj..X.].k&.Q.>gU..f...1|....[...jQ.%Zb.......t..........*..V..j.6....Vj..i.....?...IY.P.....$.j........[l.....S.4.J9.U\.......7I..[..=*N5....xW..../...=?n....uG.D..S.>...8..3........n.S....]k.*...4.>.R.o..{..l.H.#.^....<amG.m&.......,....wDY.W.m.X....We.IR.Nu...y..Z.l.._S.mr.m...y.]m.R.MT...6.5.5}.K..#%..k].7.Y.q]...%.r.7.R^jR..z.K.T[t.a..d.)glW.r.v,.`....O..^..o:.Uc.\..D....f..D......yt.Q...Y.....

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{E42A7341-83B5-4693-BB50-5515234D998B}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 17x608, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1873
                                                                                                                                                              Entropy (8bit):7.534961703340853
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:N9YMw9kGzE4xTdow1C3kyIkyM66KeJY3fOxJ:/h8HzE4xTdoUCUyxyD6LCvSJ
                                                                                                                                                              MD5:4FC8500BD304AD127AF4B5E269DFF59B
                                                                                                                                                              SHA1:9A5E3432358A0FCDECE86AEB967319B93A65D14A
                                                                                                                                                              SHA-256:B4DAA90D5A53FCBC85119050B5B76962443C4DD18D7F42CDC6D4E0AD8EFAD872
                                                                                                                                                              SHA-512:E5E07054A522EB91EFD39722AFB3776389632B8F5F923C1D29796716D68CEC93BE5E44F79913804CEC7ED631FF520CBBBAAB841E01FB90AF8E8ADF84DCD47481
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......`...."........................................>.......................tu.....45.!#$%1s."fr...2Fq..AQe.Eav............................... .........................!AQR.............?..e4.bbu."m.G......u.S.-Qq.b.a..'#..E.......u.|:.f[O..jS.S.&....=.....[.....S...N.~~...'...q....N.T.Oyf..a.6..%.I.1j.e~.4..[5.WW.Y..Xp.gn...u.......Gb.O.W..k.!mJgfq....~.F.......m..}bn4.5........s,F...z.b)..O..*...5).-.-\....=`.fP....%...A..Q.&..9.....QQbD.%.:u.f...r$.10..W.F.T..MI...9...ZQH._..).....D..n.F].........*.:.j...!6Z..S....0...B.6..Ga..S.O.....U8S_.J.>...i..?..<.P..........M..F.T.C..7.E...`.4BKcMh1j....4y...+.|.^......2[.WG.W..+......E..r/V^".R...."..6..hht..f...........;E..Kx....)}Le.A.x.>..$/).._S.n.L......}..H^Sw...2. .v.io...../.........x.>..$/).._S.n.t^;O.....n...[.S...h.v.io...../....:/...[..7yK.c-

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{E86F49AF-296E-4705-8C32-4C1D45A899E6}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):59707
                                                                                                                                                              Entropy (8bit):7.858445368171059
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:k76rvGc8WKC2/UX1uEgVRY/jvv9CblyL/T:k77Z5C2/Ow1e9CblCT
                                                                                                                                                              MD5:47ADB0DF6FDA756920225A099B722322
                                                                                                                                                              SHA1:851946B8C2BD0BB351BAEECA9E5BB6648A87D7CA
                                                                                                                                                              SHA-256:EC8CD7250F3D82E900E99114869777EE859EC73EFFABED108815F65742078C3A
                                                                                                                                                              SHA-512:85A9920E1CE4A2FCCEBAFA425C925DF33580FA3C3C00178F058539B2FBC0163866DB8A41B320E2EF2CD217F00FFA06A1A831C728D3F9F910C9EAC58B5DA76E2D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..A..Qaq"....2........B#..R.b3$..8xrC4&'W.%e.(.c.d.5E6Ff..h..SsTt..u...Gg..H.....................!.1..AQ.aq.".......2..st.BR..56.r#3.b.S.4c%...$d.CT............?....3.7...G:../P....z..K.:6..w......6....... .z7...~.....{gdF60...9....{...'[N....m.........z...g{.......7...4..1..=.z...._..p...m..Icd.~.v..9.P..0Z(.<j.......R6zm.....v.z...>x..)=g........zo{..w..f..y.t.....%.D..#.}.I.>).H.QM..cLD..x.../.^y.{.............y.=^.......I.T.......U..0_?...u..og..3.ky..K....6w...Dc......~........ik.z....N...en......_.....x....._u...4.{..P...>.....}.......>.R.....m.....[mt.....}.........|.....m......~....B.F.]C.36..q....yg...{]...+.DZv.9<.o..;..N.n&im.,....w.3...V.s...Y..e#$.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{E882032C-6D6A-4BC5-8F5D-9F4F668D5195}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 171 x 552, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10056
                                                                                                                                                              Entropy (8bit):7.956064700093514
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:edmu1fpj5DVHuooK4EpGLbAdT+dBXYBR8D1V2p6KwoPR6KUX9ojwRpgA:2Pp/B4LbAF+dBo/1E3S6JScpgA
                                                                                                                                                              MD5:E1B57A8851177DD25DC05B50B904656A
                                                                                                                                                              SHA1:96D2E31A325322F2720722973814D2CAED23D546
                                                                                                                                                              SHA-256:2035407A0540E1C4F7934DB08BA4ADD750FCB9A62863DDD9553E7871C81A99E3
                                                                                                                                                              SHA-512:BC7DC1201884E6DAFDC1F9D8E32656BFAEE0BB4905835E09B65299FE2D7C064B27EAA10B531F9BECF970C986E89A5FD8A0B83F508BBA34EB4E38B3F7F5FC623A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR.......(.....!..t....PLTE.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................4.....bKGD....H....cmPPJCmp0712....H.s...#.IDATx^.w`......$..B....... ....fz5..6`l\.8...Nsz{.//y./....{.7}g.....e.....~.......s...f.....%c...6....O.PJ...Y.oi...9..'j.2..6.-

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{EA75B201-7056-4531-8F5F-9E5FDEAD0CD2}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 814x45, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1717
                                                                                                                                                              Entropy (8bit):7.154087739587035
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:N9YMzO6BOfqH/dAIWpdAIWpdAIWpdAIWUtr/SD:/hzJgfqHaPYPYPYPUt/i
                                                                                                                                                              MD5:943371B39CA847674998535110462220
                                                                                                                                                              SHA1:5CA79B7BD7E0E93271463FAEF3280F1644CBA073
                                                                                                                                                              SHA-256:9C552717E8D5079BBB226948641FF13532DF3D7BE434C6CE545F1692FA57D45A
                                                                                                                                                              SHA-512:812541836C8B6F356A4D530E5CCF1CFDCC4CA54AF048CAC19FE86707CE5EA0F41D73C501821AC627AD330291EF58C040DFC017923A7886CEEC308048DA2CE7C9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......-...."........................................&.....................U.....1T..S.R.Q.................................................R....Q.a............?..d.. ...............................................+A...Z+E...V+E...U..R.....}........Q..Ah....Ah..b.AX..b.PZ+A...V+E...V..J*....Q...b.Q..Ah....Ah..b.Ah..b.PZ*.(.@z.?.`;2.......................................................Q...b.Q..EZ*.(..Z>.G.....`Z+E......J*....F+D...F+E.......b.Q...h....PZ+E...V+E......J*....F+D...F+E..............[u#...a-...f<.9^[...l0..H..6.Kn.t...&..3a...GG...[u#..8.y6.q..%.R:8....6a.+.3..a-....l0..H..9^M..f..m..3a...GM.q..m..6.Kn.tq..%.R:l.W.lg...[u#...a-...f.r..c8.....f..m..0.....l0..H..6.Kn.t...&..3a...GG...[u#..8.y6.q..%.R:8....6a.+.3..a-....l0..H..9^M..f..m..3a...GM.q..m..6.Kn.tq..%.R:l.W.lg...[u#...a-...f.r..c8.....f..m.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{EAF68582-1AA6-4954-A53D-F242F4ED11D2}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 50 x 500, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2033
                                                                                                                                                              Entropy (8bit):6.8741208714657
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:P37XYSDTz+UUl7DHt7Ah8l1+4ZfFclFUXwobKXlZr:v7j3z+UoDN0h8ugf2AwobMN
                                                                                                                                                              MD5:CA7D2BECCBC3741D73453DCF21D846E0
                                                                                                                                                              SHA1:E34B7788498E33FFF0CFB00125E6BA9E090F6CED
                                                                                                                                                              SHA-256:E9EAD0BFC09D32CB366010CDFEDE1C432A2D1D550CB7332BADAC1BEE9482BC86
                                                                                                                                                              SHA-512:7FE2C3654262B1EEBED4F6D83DA7D3450E1BE52500A3964185FC0092041506A237A2728E5D7EEA0A3814E413E822B803B789C49CF744D51816A2E4EDE5B4247B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...2.........H'......PLTE........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................[....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.\.W.G...=a.ewA..a.!r( ...%Dc..x.x....N.OO...3=...S...........~.z.D.0...g.2P.7.*M.#'....z.......3TPj.Z.[5....V..z'L3...a.j9..C>..9.z

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{EBF06814-24EC-4672-9B86-B48F0C6F97C9}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):25622
                                                                                                                                                              Entropy (8bit):7.058784902089801
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:EhK81gTCyJ/Gf9Aw3t8w8EtdPeGDh6bEi1Ie1u4ZbvgwTwrSRh7ZKNpIGY:IjcRXwdJvtdGsUbEi1IeY8vgwTyC1+Y
                                                                                                                                                              MD5:F8CCFC24DEB1D991EBE085E1B2D7D9BF
                                                                                                                                                              SHA1:AF76C22A765434AEDA134924C517C84107F4FED5
                                                                                                                                                              SHA-256:7354001527AB554C44E7D6981B86DD933B7DC2E0D3DC8512AD3EECD843245C52
                                                                                                                                                              SHA-512:818BC3690B01B30BC571E4CF45EC8D1AFCAECBAB003532644381F1CF730A5B3486862D08F7579B2D3D89167AD7DF35028881245C9550B0DA23D1F81A720A9704
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!...1A.Qaq.........."2Rr.#.t6..B..3S$4..v.b..Cs.%5..8..cUV.(.DEe.&Ff...T.d.......................!.1A..Qaq...s4....2r..S"BR.3....b#C$.....c............?..D.."}:......&&...?3..W.q*.......]...m.Y.k1......K).J...uV.b.../.0.E.H..4..W_T.[t.V.w.9.x.qe.L..o.oL.....d.\.....6.|.o...}..H{Yn..E...6Y3.l.e..D.:,.n.%...t...m.........,+,..|..n.....6.*...f........6.../$../Vi..H...e.f.F.zn.).n.E..2sTn.i...Yb?6+H&...Bf..*....z.o.^7[..u.:o....t.s=.....(.s.....f.g....q9o.u1L.N...smzE..[>...+\O....j.<....j.c.W.............U..+.F/.'..W...T./W...>i01./....j.s."..Q...{...a._~OW...Rp.)*.e..W..Q4)<..'..W...q...'..U..z..g......U}...O....w....0F:.N..V.3W.|..'z0.]...j..U[v..g$D.Lc[.e...UW.m0+

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{EFAAA0E3-A65C-42FF-8A66-0FAAF5623600}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 728x77, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2695
                                                                                                                                                              Entropy (8bit):7.434963358385164
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:N9YMsguOZgKAz2vcaQU4R8r4BU0/Rc4nbIQdsohw13ZmFLY6KsVvMdBL2mr:/hsEgNz2v5T/rQC67SoWniHK4EdBH
                                                                                                                                                              MD5:B23DE98D5B4AFC269ED7EBFDDECE9716
                                                                                                                                                              SHA1:10AF507A8079293A9AE0E3B96CF63A949B4588AA
                                                                                                                                                              SHA-256:646586CB71742A2369A529876B41AF6A472C35CC508D1AE5D8395D55784814F2
                                                                                                                                                              SHA-512:BBACBE205EC0A4F4E3AB7E2B1DEE36FCF087DDF77C7D18B53AEA4B15984A47C64E19F9B8D8FA568620619CEA0361D94FE7ABEA6E502EC6ECAEFE957F42ED7EE8
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......M....".......................................,.......................1....!ABQRq.2a."CbS.......................................................Qa1A............?....{............i........l..-D.q.~..|cS.S...R\..d.8,!.....]f$....Q..di.;~5......vj......MqCe..=.*.f^..=.}.Cm]qCd..s=..u.e..v..t'.,.....S.s..N...>.d4'.,..k...N...d..9....G...y....6J.Y.l.{Vf...^B..i.3.z....:5W#4@.S\fj.%..Mb.5.v.5......S.E..#.v.I.....I......m..H....D..|.Y|...W.Wf..o..U.0.E..@.T.....................................'.S../...Z......!J..1K..rI...T.f.>.+.N..o.....\..^u........e..q.qK.GXP..-...F8".;5J...]Y......j.a.,R.......J.N........z}<qu..J.)`.}X:..}.............B...[. ......,B.).b.......(Y.O....c\.o.e&.W.#Bo..N|..N8.#J.>1D.1..b.&....q.#..UT%,.d.....m&..^...VXA..b.nbTV~.....^........q..#./.I..=Q..=..Y.*.Ib...VZ+......Y.........'.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{F5FE504B-5D53-4945-BEA7-FCF1F6DEB503}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):15740
                                                                                                                                                              Entropy (8bit):6.0674556182683945
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:Elv3GG8/OOs+GouFdxMlxjoPyerzkpuOo2vPMc62PaJseZC+BJoS/:EtNiwdxMlZoPhzkpuOo2PMc6rX8+B6+
                                                                                                                                                              MD5:FFA5EC40DC9A0FD10EB9E6355142D6A6
                                                                                                                                                              SHA1:3D3D6A7E086B3C610C08F1F3E3F883604F06F2A4
                                                                                                                                                              SHA-256:D74C3973C8D1F7C77274691AFB1AA934940674341D7EEE563BE75E563281BDFD
                                                                                                                                                              SHA-512:6FAF2A24D06E6008F3579C7CEC90C2887462BDF83FAD7372FBB74B8DE90340B580E9836F309B68A9794597A598F7DCDA661C9A58DA6D8187C69083B7A17C9CD9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!.1.....AQ..aq.g..8...."r....2.FG..#.E..7.Rb..Cc..D.v.B..3s..$d.%5Uu..&6fW'w........................!....1Aa...d..5e.6.q...Q..."2b.c..r3DE..BRs4U.#C.S.T............?...u.&0...cV.T.I...1..=4....Ce_.g.q.=F.M:>)...k..pm..h..=........S....)Ja8x...b.).=5.q..0......k.M.....1?-.G.b&.5..Ep.8t...'...R)..ta.F$bXO]tW.b.6#.t.XWN..ZW......].....G....x&&f..'L.....7...\...'.8...~`.sa...............................................X........qo...SMk...'.V...i..hb.}&?/.k.:>l.^....>Y...<}...&.jY.Gn.MKejyV......D......gf.0....t.nw..XQ...H.B.....=8.UkR.....Hm..w..]...k...#Z...F../.gjWvf.....w.aZ].2..5..^...VZv..._.7..a.|...:.B...,f...............~....m.;_.....-.e.y.w.[m.].bu.b.f+.E++\.....Y..7

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{F7275AB0-1D17-4803-9474-7DAE219607D0}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 40 x 623, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1569
                                                                                                                                                              Entropy (8bit):7.583832946136897
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:KArPoy/sSfmBL0EGEsRgeTLLXFnViAAEslVorlP0i8OmO57EnGAkYelBKMN:9oQPTgeL5ViAe8rQs7HAkrlc+
                                                                                                                                                              MD5:07DB3F43DE7C1392C67802E74707DAA6
                                                                                                                                                              SHA1:C173ADB1999065C5E1E6DBEF934B4D4D7AF0CC23
                                                                                                                                                              SHA-256:51E05999A1C9F17DF28CB474E57DD8E64BDAB824874A532C20A23766A01F8967
                                                                                                                                                              SHA-512:E509255519D4E521E82332FF418DD5A6BBBC8476399A0D9C3D81542C1CABA535B2D79E5BC90F73F9EE8468643302137671934ABD600FC696F16161C91FEAC111
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...(...o.....>.c.....PLTE................................................................................................................................................................................................a.o.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.Y.. ..........}%.../].`<..y....V...m.....<....)..;Ki..'9...2.:.c...t..V..d.t;-y.Z.=K>B.."{Lj.~G..|..ENC.!Sw,....";.p..g....E.B..S.-...k..P."..E......l[./D.-.....Q+.G<>.+..b...#..y(...{a.M..J...<....v.W..F.qm.`.....(.mk.nX....l.Px8.0\Z....7G...$*.....&..Z.VJ.~......J.2|...2H..../...=.)q....ZT" .,%..h.p....Z$.!........r...Hh.f. ....P .d..1d....2.3h....;.A.... ....d..g4...A..^.....2.ew..."h...y/..j.h..B.......%.2.%..{r...+dG.=9h....P1...A...c...^h.]Q0.8x....q .!3....ZW"Z.!3...G.vC.GG..".&..X!3.|xB..V.P!.+zS..NX!3.....Nh.y(.Z.1.h..B...Z+....l8Xcu.B...K...@U..@Q...mB...x...&L C....mB.....@kC...Y.,.... ..e\F.B..........y..e\..:$(....Z.a...yn...f..z.~Q.{o...].ln.r....^.@.{..c.7..{...

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{FB4E0155-E65C-4C42-8BA2-2592BFD4548A}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12824
                                                                                                                                                              Entropy (8bit):7.974776104184905
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                                                                                                                                                              MD5:2628353534C5AD86CBFE57B6616D46DD
                                                                                                                                                              SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                                                                                                                                                              SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                                                                                                                                                              SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{FB864271-ED26-4B21-BF54-8544E2D69264}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:13:06], progressive, precision 8, 570x779, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129887
                                                                                                                                                              Entropy (8bit):7.8877849553452695
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:QS1x1rXglsteJ79wHi4vNQR5yBlUdOSILe9hSj9jeWMPjdlOJ:vvglst1HiwWR5yBA2LeS9jd1
                                                                                                                                                              MD5:737E96E41D79D3BDACE7AB4F8CBF6274
                                                                                                                                                              SHA1:E6202A41A4F86B27D9EBCAEF7670B16C0ED67CF2
                                                                                                                                                              SHA-256:7966F3D8A2D61ECB49A35E163781858E052C0B122A18A1238AFE27B57E2850E8
                                                                                                                                                              SHA-512:D398C8521DB2FB3F8456FE792CF37472F3B851DD7298DB20E2DB79144F8E846D051878E77E5EF5D00E6840EDB90C6E2D97935BC1023A15FC45038CCE731E9895
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....iExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:13:06.............................:.......................................................&.(.................................3.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................u.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...W..I:..*....a....Aa ...w.T.M.v.........3x.......8Y....$.."-..m.I.0~sxB[@..=...:..\.Y?....@O.L;9i..U....?.5">+9.s\Z..vN

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\{FF0C1AC8-A96D-4D82-9961-DC2ACECBBE5D}

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:06:24], progressive, precision 8, 38x792, components 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):22203
                                                                                                                                                              Entropy (8bit):6.977175130747846
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:5q3R1VBvq3R1Flrk6Q0QPJJrR39joOVMJ25d1NkMhIwobbtAAAqYnLJZMJYZ2AC:xw6Q0WJR3FoOVMJIIlAAAqYnMJdD
                                                                                                                                                              MD5:2D3128554F6286809B2C8E99DE5FD3F6
                                                                                                                                                              SHA1:FC42CB04151D36F448093BDEFE33031A9B8D797D
                                                                                                                                                              SHA-256:14FA2D16310485AA1CE41F6D774A3D637E8CF8B03C4F72990155DF274FDB6BD9
                                                                                                                                                              SHA-512:D8531247A6E89ECABEA9C4A78F596CCE3493334EDF71AE4F7998FDDD0F80705948609C89756AB56FDFAB6D04DEC5F699A693801A772CA2EE2465BDD2CE5D2D5A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......JFIF.....H.H.....XExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:06:24............................&.........................................................(.....................&...........*.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...H.....Go.Kxn.b..g...........%?_....O......q......7G......%%.V..8zm.].v?...jJ~._..>.......O;........o..rI.A.....n.a.........

                                                                                                                                                              C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Collab\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Forms\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):256
                                                                                                                                                              Entropy (8bit):7.219478369030762
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:p0oX4NoahlcG4dfsVNc/LdJMbzL3Sz4EdOmzKcqymokUD+tzwMFSUNnKeGgXlUJ9:XI6ZVUVqpMSU6JKcgsScMMUnK9Y240pD
                                                                                                                                                              MD5:E93C32409AF30CAE07F0E684A710CF96
                                                                                                                                                              SHA1:7147ABBA4E06672C9E3E1C7AA04C497A6C25412F
                                                                                                                                                              SHA-256:E6F98304327DDE7DFBCA78B6D9A350322E8BC0BF6E0F450B7C36FD91E9176EA4
                                                                                                                                                              SHA-512:CB5B2B35FB3F2BA9FB55F08BCE58D0B934F2FCA01F699FA6EB14DA4BCA08367B0F9937BA3AA4597A4EB4465BE2C697EE245B3A1522412D4FFD669BE00C397F19
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:]..H..b...9QU..r...}i).9..+..&...<..K.-y&O..ct... .'.t......s......../P.......^....$.>..YC.......iv.[1.....G....d..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:COM executable for DOS
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):266
                                                                                                                                                              Entropy (8bit):7.243430920405188
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:bNwROw+GZWEKwjV4S237d3BZV/O+UVEERI4cqymokUD+tzwMFSUNnKeGgXlUJJ40:bNKKQ4vLd7V/bK7cgsScMMUnK9Y240pD
                                                                                                                                                              MD5:526D24D3EF403F81618CC0DED51CA45F
                                                                                                                                                              SHA1:79F0A04FAF03F1778B9C531D4DE4E9D5DB537EC5
                                                                                                                                                              SHA-256:FCEC187A899ADEC42AB4AFF47707A84A78254FFAF6B02A5757C24466876082A1
                                                                                                                                                              SHA-512:0621BF379D4EF4158A865EC6C65A2812FEA340772C3D75FA3DB6BED117EA8518AA02F44BB943A9631E774B026EDAB9591BBBBE4640892FD618DA90AB4014972D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.r.....\....,.@x........9..+..1...)..%.JwU...cn...r.$.t..i..xt.Vo.j.^.PR.kc(Q!..[..$.x..&.>%m.:"....-...H....M...7!....=4....l..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):67083
                                                                                                                                                              Entropy (8bit):7.9975622927644014
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:1536:S1sXp8FI8rD1xZjz70B8QKBwCldNwwiFSjB8FlyFt:Dp8njZv728tDo2d
                                                                                                                                                              MD5:509C1E7D100209C24F87CA1FF1A52B21
                                                                                                                                                              SHA1:3123F21531C44929ED1B055277D39CFB7B4131EC
                                                                                                                                                              SHA-256:96FEF6EDC4500126AD20EADE386138467F8C107546E62B8A27F3ABD993874EFC
                                                                                                                                                              SHA-512:1722B4FD0194DB5D26725220A474AA09321A1509EB0D7A040A0266D027EBC40D065B6BA88BA16A6E00D6867A345F508C5D39E710D252033EFD15B9D308D71C5E
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:...s:}P..K..`.../@...j._.g\....w.7..$*..xe...q8.t...$...3)t."..*.k3..{I.].h[...%..-.....H...1X.WB.T.|...x....l{T...l..Tn.n..d.:...n......1..L..%......#..E....s.S...6V.4u.....z......99...|TR..L.xv..=.B.Z,f....6`b......s.".....4.A._.P......]...(..../.rfmnC..m.'...c.J....e.Q[..vq.?W.d|u....n.dY.c...M. ".3...k...H...q.K*M.........5...C...~]O.qCE<~.@./.8;.F2...+>....VNZa.r3.... 2..(.BoxD.vs...s...qr...&...D.5A3...g.j.........!0T..#z.q...-.....%...h4.]s..U.....zW.9..y1.."`..3.k|..Wr'.C.@.....N-U..g..([......S._.c=.<.&7.&.1...P9#..ga8 ..._VE..S.\.....?....m.......U.p....n...........:..1e.0.r@..F.s.D..A.)K6...$.^_p.(....k.E4....EL....1......<.jx.V~.~......\h#.v..5x}....O.ml.e-...(..X6&..t...Z.. Rm>....'....%%4..Es...1..a]..H..I..)....:9d......"...9...cpq.q...<.'..I)..O....+F...|.`..........b..r.5a$../l...n}...d[:......?..=..L..\....8.x...e..Y...H.....U.;....Z|...$....a..l).:..)..5...N..5;$Q.mg..A~yX.j..`0.CB`.M|.....10;.t.s.Wf.r..y....=.:snr ..`

                                                                                                                                                              C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1017
                                                                                                                                                              Entropy (8bit):7.806913662614615
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:BxgWQIdk0Uv4DcFcYQBJqaO9dd7whFo/Bmzbmv+:BKWbmvN+YY8zBmWv+
                                                                                                                                                              MD5:753B76393AD2C072B9217A01D9B90F45
                                                                                                                                                              SHA1:55396BEF7C5E843E12D216E6E7E3A7193F141906
                                                                                                                                                              SHA-256:8EC9AF73FA849EB056FBDFE46B53C9BE12FD7E140CF22ED35A5DF64CE8C1C3E4
                                                                                                                                                              SHA-512:23CD942D24BEB3F47ABA8CC240482106E92D5CA812E687CFFDDB223FB63A604228F675FACB6B7BFAB5E7D21EA48669A7AFF6EF3E5CFF41E8BD5B75DE13FA3921
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..(.W.n. 'Bq......J..gG+..H..w......`..`0;;...r.6.......Z........%..%AJ...o.........7.)...Yq.[]N\#..3qN..Z....uN.@._.cB!.y./...@{.u[)...M-.a...."DR..H.or............@.!....\Y.S.......&t.bU8.v.......@....e..vI.|....K..gu.y....O..G3.....c(....-.4...y.....7F@....w@......>._BQ.._..'k.!%..z...S.$)`P..=.W~...V.s._....4!.p...j.......A.:.>T..C...<k..:O.P.....Nl..S\..`.I.".c......JG.....(..l.<.f...T..`..<|1y..R.......m{.J.SA.BB.z..1.9...]T..s....W.K..k&Gd.4>...y.c.TQT.\..q.-F.....]dc$xD....(...+..Ml.Y..MZ.*.uG.^S.,.)."..<wn...'....d..GAa..(.C[..i.....;.!.u.'?.t.iVzj..~=....Rk.?......Im!..)...C.....MT6.6.B..?..+..e..H`.F...8...r.%.T,>.w.l.t4.op....j ..$or.X7<F.+.xK....g.,m"3tv...A...3..0..q.7.8.:.9..v...sJyI....Z.4O3,f%.0.....9....X...5..].6?..1....]..'.<.DmwM....6VqC..'^.W...d.J.Sx......$.....3........j.......||.L...;w...k....H. s.......X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..

                                                                                                                                                              C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_store.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10483
                                                                                                                                                              Entropy (8bit):7.982345729805202
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:qUfOumzHDJ/tYdm3UcEY2NdOSTA1FN+9P0zASXN+B8I6X023+:qUfOuOHDjYdm3OYvSTAd+9P4N+B8Iw0D
                                                                                                                                                              MD5:9B775F2E04A516DAE8CF9FEE6C61B11A
                                                                                                                                                              SHA1:EC6DEF9CF25E00580BCA2089CF466A4395E55B1A
                                                                                                                                                              SHA-256:C4232E62A92122D2DE4A620C96D5EFCE824B27E45878F850B0A116FF89523C82
                                                                                                                                                              SHA-512:632AC47EF5EADA5330293631FDA2F762A8341FA47087B5B1CC3DBA09FD33A2019E6E1D7D757BD96BB9725C0ADDD5837C512611FE5C4569C7B316641D7F306A9E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.Q.iZ/GL.i)`7..~.t..3..B..z.e.b.s[z.....m..r7%...bd+.e...U.N9.iE'.jy.T.I.5...._f..i.T....r.2#..R....qu...Tt....Z'.T .pJ{...e.ZP..NbF.h.s....K..j....!....E.[......0.....\..,..|]>6.0.V.y.$Be.s.h....*...R%.....................P.<|A.....B....^S_|?g..d...t./.X~.....^.!..'..Z..c>..B. ..cy.........a9wv...t.B.s.,c...M...A...h.Mk..EO....B2E...,~..g_.%.8...\..C.......X...t..a7&.~...%....F.;:.Ix....$..]...2K@!@...L.9.-.Q.)..3a..K}G.I.....u. -.RGd....2.2.M~...3.a.@.$C......e.Y.....bI.....$8..p....`.;>D:+.-UD..[.a..u....x.6.."l.<b.tl.8.V.....7p.-V...].*..p..0.ZY....H".............e.$.(.n....0..G>.;s.aV.....d..6i.`.t...5.I............Me......@.!...+.YvzR.H./.r.....~.E..]...K.Ja.<oYt%.H....lv.".p.eo...A.c...31.e..L..0.b.r.@x.i...F.PJ.!....=C...=.~*...;.%3Z.y.~.C.....?.....z)j.vWb:G..8.W.........sU=.3L.bH|9.\I.-.......|.j..,E..T.\~...T...U\Mv.SK.|f....h....|.=..*.!.P......<..K.....+Eq..}c;.....(.....#V.lNV.|(...M..i/...9...F.>T..{C...`w......&."...

                                                                                                                                                              C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):24396
                                                                                                                                                              Entropy (8bit):7.993069838739685
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:384:Xcgj3z0KPiTRP6IwXgLN7aPSdi9FgQy6jLE4J9T5lPOOySeC6pH22N7lSok4/hzb:hz0KPi1P6I/aPSITYgEEPySejWY7lSz0
                                                                                                                                                              MD5:43E42F5127D71CA09A0FC3BABFD19D9B
                                                                                                                                                              SHA1:6658C1BE48AFABDBDBDF280630B97352C7B28995
                                                                                                                                                              SHA-256:25AF70CBA5E6AC635AB28ADD8B6F35286F56D13CD008545CD87615F5887893DC
                                                                                                                                                              SHA-512:B98F19A8F75FF2E60EEE917C3A89E90FED05E14BE80B1598C7877CB85D38CCB08ED459DCA0519242F993919E349C71598D4B9D79EFB38A06F2EFAAF768A1F8DF
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:X.F..)0.gK...BttZ0...$o^t...3..T.z..las.$....N......~.2.Lr./$..H....A...*sKqK.T..E.}......3.Yaa..&..l...g..|k#s.G".`..A..8.ft....-...Y.5.|,0@... )4....$xJ......0&.o.VT..S......2..!.B._.....K6...........SM.3..`...%T..aAmG(u.......\n..$........^....)D'...9g..Q...\S7...."......5.3..5...w..UGo.?-.(.<.....(#.)..`..@..V.....k..BZ..5|....C.N>.;.!.P....-.'Z$(...G...4.7.=;zG.Keg..".]7..W..Aiqjq.[.}.....5V.*..:J.ni..}.l.w..BR.sgwq.1..T....3..tp..o[..."...Z.P@,......3Z..r..{L....JD..?atev...k..@q.....y......|...+.#......z.0F5$w.L..,.Ejw..4.0;\...%.g. [.....\......w.C.G......_l.&k..F.<M1..4.o.5....d.........[..(....[..........rrX......-[..............[+.R..z."{.*...[.R...3.#.i;.z.Ko.l.....'.5`....,'p1.eISS.x.6......M...%..s..".Bx.KU.z.3z..@.4y.......}\.....Sb....O._.stFM.....ZR.o.M..aq...my.?y..'3..wX.~.AS.[%!.,]........J.Hc..K..8..p...7.2.j&...q?._.D...<....]h..w3...8B...#.([p.$(.V.'.dtp..*).UD.sP$.R.g.'v...+j.e~....0:Au{I.].\6....c.[.P.t.L/#.O. ...z.

                                                                                                                                                              C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storek.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):509
                                                                                                                                                              Entropy (8bit):7.573498946257405
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:/1ZF4ylFt0zHbtfPH76hzxfgppmYimreb8o7BJLjxVysyETG3KzCKowXcgsScMMd:Xh0bb1bQgppfXrW8onDKEcKUwx3O
                                                                                                                                                              MD5:29B6AB542A743CB8E2F6C2AE25433AE4
                                                                                                                                                              SHA1:89D8162AB8D0ECB7653167015C41AD3DFA0EF996
                                                                                                                                                              SHA-256:647565157F25B7A4A70B906540A4624F9EC34B5F0AD5C20DF028B0D0707606C1
                                                                                                                                                              SHA-512:C085D13C229F5ADA91C89E4E5AF6ADDDF606613A284DC4043789E8F66C70F005033EF5465B08291E271F0170BAE652C5C6646A335F767A4ECCDDFEA18326F8B5
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:$_=$.l[.W..5}f.i1.L...*..-H......MT..o..gT.. .......VL.l......`IR.!..e.Ky.GG6.(.t.| .|......q_".-......X......4.m.:../...A........S].....m.........^<G.`.h...u<.ZG=p.......X...%..m..[...>..X....,..(vX..........OQ........L...../B.v.).@~..Q.....9..........&.A...YJ3o.~.vo.. .$.t..i..xt.I.w..(.keA.L....|../..HS~......&e:........Y...uo.|g.Tf.j..........o..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):14703
                                                                                                                                                              Entropy (8bit):7.9880689691688325
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:Z2uBBtnFo2MD8MHvscDeXAIBtpI0FsJfYDmoJyICEUA0IRlR+Mbq7Px2+RmOcka+:ZrBBvQCns6SG0M0unbnqcka+
                                                                                                                                                              MD5:FDAE1B02545B182C3FA2EA5977E699AD
                                                                                                                                                              SHA1:5E951808D012B99B10397CD3F139A574C8A9F4D4
                                                                                                                                                              SHA-256:3EFA067803B5B765B5BE5B758EFE30C4438A9A8E839560BD6F4577B166ACE121
                                                                                                                                                              SHA-512:B987C1B23BCED501656489A8D5494D83873557507B06DE0214B4637FDAED087CD57ACE783D40C7030494D2E019F3E049171652E65A1DFC51C25691D3DE462AB0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..J.uz....fz.....4........J..........-.M..^3...~=...oj.;.......9...G..&.......M.:...l....e4V.8.......,........w..#)..%.4......O...`m..).2.P(8..%....0G.h...$...K/H...s..P.Wv0O...*...E.u...6.}...].....Mns.....$1<.<Z...=...<`.r....^yl/..<..h...r..=...-..d.Dwm.0.....;u.*.../.D...W.....".(.f....Wh.._.u...2C.w...<...&F...J.5#....L.>...`.........yTY.t...........G.Rw.K..{....c....<<...'L.%.$h.p|jl9..K.M..@.#..w..m.EDj>...'.j.emyg.%.....i..0..J.2<.4.n.....{......\..T..@...Zt.k.m.....18C..^BI...z....".V..|.&._]. .t,....xte}....)l....3K.....nB.....s.k[.W2Y?.W.C....^..CS.+...W............X...D_..yQ.\.4S.l..A.Y...5q..3.Z...n..7(A..G%~.._.Y.l..0.Z^.B.s.m...K.........".}..-# >.2..(.G..f.7yI..[...8.......%.?X}.W...y....v%.z>f.G...?..|+e....c|.m...P.Rf...dY...LZB...e..|...%.@..Q....PP.Ca....d42..|u..g.... D.Sj`.\.s).h..`(.p.:.D....m.l.....P...?........V!..i.f6\.U.....xqd....=Kz'...W.W.|\...-....d..;.Ys.H%/_.F:[.&..^a..;.gZ9c..y.8.+m...2BM.~L..e...._......

                                                                                                                                                              C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMDocs.sav.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):274
                                                                                                                                                              Entropy (8bit):7.193554688812804
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:X8QVR4MFd2rxxR2v5aESRnqk0FcgsScMMUnK9Y240pD:X8Q74MT02hyqk0j3O
                                                                                                                                                              MD5:FD94201D38C363F7E1CFF21D2365F707
                                                                                                                                                              SHA1:6630D6B75AC1727E1D5C014EDC1FD0BFC1D4F47D
                                                                                                                                                              SHA-256:BB3CBBDB187E026F8CF9E45C053F0F4579F8F105B9F83E860BA83A20B849404C
                                                                                                                                                              SHA-512:783F72973E68758A68B251BB71254845CB697C2C6AE0F7E4E6EF202F0714608CA10F016CC88D4EDABDB2341D259613D3402F2999F97CD53A463EFB2A525037E1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:;|%.G.L.dt]...T...P\..W..........6.9..........)..=./y&...c&... .'.t..i...G......u..k....l\H...{.E..f.wO./c...;.=.. .Q@.tl.....){.....h..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMGrpPrm.sav.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):296
                                                                                                                                                              Entropy (8bit):7.263951169762595
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:/DmpTVwoMI3s2LYFSXDGHzoZgAeXxt+cgsScMMUnK9Y240pD:qTSoMKZtDOz1Auxtg3O
                                                                                                                                                              MD5:FA4325A0FFEF694F0189FEAB145B5D01
                                                                                                                                                              SHA1:AC342FC85DD802BFA320D4DF3EDEC9414E06E336
                                                                                                                                                              SHA-256:0E3CA7DD7E1F8EB0145750375CA342C12AB8F6AF944F324CD656ABEEBDD68D7E
                                                                                                                                                              SHA-512:97DCC722C118164D75EC4259DDBE7D814E95C47B470DF4B1439240E1A9A7796289F3B9FE91A700061FB37D35C731CFCF165D9B2A9A0E7C996E17508BB0DC7013
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.......T...w....w...."....%..^...E...+...q).b.....Y.9............8.LwP...cn...r.$.t..i..xt..us.r*7..g<...C.K]M.o;.>..%.tJ/..w..[..v...X.h.....9>..@......l..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Adobe\Acrobat\Preflight Acrobat Continuous\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Adobe\Acrobat\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Adobe\CRLogs\crashlogs\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Adobe\CRLogs\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Adobe\Flash Player\NativeCache\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Adobe\Flash Player\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Adobe\Headlights\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Adobe\Linguistics\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Adobe\LogTransport2CC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Adobe\LogTransport2\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Adobe\RTTransfer\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Adobe\Sonar\SonarCC\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Adobe\Sonar\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Adobe\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\OneNote\16.0\Preferences.dat

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4456
                                                                                                                                                              Entropy (8bit):0.43652526424985216
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:zJfIo6SYyfhcD1RRXUn/cXap+0hh/q+J+/KRujslll:zJf6SYyfmJ/U/cXaEWh/Fw/6/l
                                                                                                                                                              MD5:3CC7326F2B9366D124DB371A1AB64794
                                                                                                                                                              SHA1:81B3FA0CD4D62852D3AA8563AF0046CEA7894718
                                                                                                                                                              SHA-256:E7BC032304A31613F6B236EDD8EC3242EA35223016595054C430CC0761DA800E
                                                                                                                                                              SHA-512:1E9986DEA4988416D49A6E4744DA87334F358280192C61882DE27425AB23C1900DC1D746C303249E27779AFB650F31CFE1B5C74E23B61CAD60070B55568A0A9D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.%c....L..=../\..._.D.B...AGj..................?.....I.......*...*...*...*...........................................................................................h...........................h..................}..K...]............X..Vh.E..E..P<............................... :.. :.. :.. :................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Extensions\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20230927232528.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):267
                                                                                                                                                              Entropy (8bit):7.136844656405147
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:dRyGUYQwvgcrTC6Cu3MVzcgsScMMUnK9Y240pD:uGRbre6jYt3O
                                                                                                                                                              MD5:BEAECEB07EEC68A4F2FC6A5DB6E02A28
                                                                                                                                                              SHA1:034F2D21CBF8E5F3F55315B9CAAE86F5C65FD9F5
                                                                                                                                                              SHA-256:8C92DAF06F4A1FAD80C29FF18C2B75442760947E2F4F2844CE5731F0FE011F83
                                                                                                                                                              SHA-512:21C88F5AB2E37269B994677EBBD88A0EB6BE557B4A39621B9CD119EBCEF10F314963465C593295808762704E5DB61C23ED67A216C18916771586DA9A9F916454
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.5....&T...9..7..........&.Hw....P......(.|......Qt.IBw=....5.Q../....I$4..`.-Bi..l'..FM...I..60Y?..K.7.....\...f\...T*..b...1aB{..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending Pings\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2455
                                                                                                                                                              Entropy (8bit):7.930925737335847
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:cJtYPfh6oZT9492RPYsrxErBGITVCXiSx3S9lsGs6C3WqqDXX+NTS0uw+:cHYXn4egrrKyUIsGQYDX+hSbw+
                                                                                                                                                              MD5:0D30016EEF9B7AF357E437F6AC6FADC7
                                                                                                                                                              SHA1:E3CE879246528D38431C867720616BF55B28461E
                                                                                                                                                              SHA-256:CDDAAAA472C83C292786E313BAC058F32079B3B0162BF33F0B96C3FFAA72D170
                                                                                                                                                              SHA-512:3901A91C35B37ED8B22FB31217B12B3B6754D5D61EE55478536EC98C6DDBD2FACC4AE61D3456998C7B07E1F24D305A84814F5272544271D011511A8451529A77
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:,.:p..._......3.(............m........qr......*.u.n....o~...."..!ZB9.Uj...J..o.Iy.w)."r....>.,.L.5.4...K!....<?]..6.x......)d..P.....d_*/Ii.mk......@...=J..W........`X.....8n.0.._....1....gU..'.......n...K%....N...........2(.C.....ac..`....9}.R=."..H7%.].O..-%S.J..wec.l..Z.440.;...t[5<y...= Io@. iO+...q..f.....s.U.(....M.v...U.o..2N.3...O.}..5[H.%...Lb......P5LK.R........p.;....V..^C.C.U.c..._.v.~....0.{#.p.....b/R..\...R.Z.v.4..3\.Bq....xwB...\...{f/...F"wz.)=....d^n.?.G../..z...8....f..x..F........F.w...h.|@.h.Kx.)...5....'..Sc%.\........!.y..S.D.Z...a.g...a.....!T!...7<..A.]u.....N.I...}K.=..2s.1.g..u.$.6N.....4..z.3...e....."j.r.L^..H..#..[.U.~.......,I..~.7..w.........x&....a@......}.A..P..e.[H.rh.[+u.+.]..gm.XlQ"gc...;..0....XcR.@....Z....x..`NM.q_...Q....5........('.:..l...n...t?.".l\......t..@..1Os7.....I_3@...G2.. Bk.7.U.Z.\......./s."x...9.j....0..=.uo.B/......O_`...{.v.....c.%..*.......0.7W....;0...i+00..j...=.K.mt......y.|EF..x

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\SiteSecurityServiceState.txt.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):785
                                                                                                                                                              Entropy (8bit):7.751460226015576
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:pMsjJiWHzBCEZAWLjky0LxvcKYq1uYaouxpen685TWzkkRXMXRU+CKUdjLCJ2Esw:OaiWCEa7yykq0ou3en685TWayK8LCJW+
                                                                                                                                                              MD5:6E9B109C1E8666DC1F7CCC9AFC3D7C4E
                                                                                                                                                              SHA1:71C7C0FE0B1D8F14241ADCD123048441460E38A2
                                                                                                                                                              SHA-256:2EAA041F1E00AB848B779B19A952B3F031DC0AFF0F1DD0D5B3E1F28437CC91F8
                                                                                                                                                              SHA-512:1F3C7FDBCBE04B8E19C7D07627B5491C7E93685A0F98631590A2AD2D129BC037A4AD84E555196E8EBCE1E86C1B257FDC253F125C16028E33EA45449488F7681E
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..Eu.k..,....{..e..=o...Uj..u.....#.....A.@..V.R#e..(.IK.k......k..H....XQ..P.o.....yh\....h..41..:...?..\P.r..Rf.r+..........q.r......R.&..<.=....tX#..4....Qn]..eJ...|.[N...Fv...X!.K.K..Q..|!6...o...U.k2..8.;I.ZX.%+.pMk......d./Y...;O@.o.Z...`P...`.....D.....Y.....\...].......pK.3.......YY..&...a......pvl.8...(...w.q\...k......Q....[.R....:hH.|l_4.'0..D..,....V.Ce.D..7u.B.U..g....M.).....z..j..&r<[.G.0V;...zp.....Y..22.\...~..'....gy............+....i..@.Etx5+.}.}..+Q;.8..I.hQJ&..*:..W.dh....b...q.b."..9..0..J.h.....KaP..v}..?..)....O..x&.I.w=....6.Q../.".X..M1........W.,..B.(..$.L..l|.O^.D...$.Moo.5).g.Bt....mx..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\Telemetry.FailedProfileLocks.txt.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):266
                                                                                                                                                              Entropy (8bit):7.199313110279208
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:qiZ+M1jJegW6Y/YVXfuKAmcgsScMMUnK9Y240pD:qiZregG/YVXf8Y3O
                                                                                                                                                              MD5:36798390985D5FD9F8813E7596E297B4
                                                                                                                                                              SHA1:BB9CC984D74E8EBAF5342FE71F31C9443B6495B9
                                                                                                                                                              SHA-256:52E336C97C8BE4BA23FB71C4DB0C89D368D69983C89CE56270037414390F545F
                                                                                                                                                              SHA-512:BE70B1C907DA468FB7D0AC3EECB769566A5A16424CDB8EE006BDE982EEBDB971B8E8398B26C8ABF42B081994F02C4562CC99DE9F32623EBE05843466E26AA27D
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:~.9..(.$...y.....LlO..qP$..F74........5B.1.u..2..5|Q../...'>..mw... ....-....U}nY...)...rVm.....H.....w.eG..r.e...".......%.\...X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\bookmarkbackups\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.ini.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):445
                                                                                                                                                              Entropy (8bit):7.492010733961855
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:00Z5CMwGmNdIkiSs2BGX3+EbSnRelv86CdCcEnwXgRpTlJU2EzcgsScMMUnK9Y2H:0Ch2di2Bo3+qSn7r0wXMphJUH3O
                                                                                                                                                              MD5:9A66F311B5DA40E16483697A1A441849
                                                                                                                                                              SHA1:AE00F0CB77B0735C6B65D579AB407F3BDF9058EA
                                                                                                                                                              SHA-256:97736ED4CAC7F7DE234B47B2919BF10E7541467C115CB960E03D7181836467D9
                                                                                                                                                              SHA-512:DA53277566439A9A87612CF1F87D8905FE529E2739F4DAAFC8116DF38B9FA215330FC29378D2862AE989FEDE963A1038487E84C994945009334E76FCFA68564B
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:......|.....5......hn.....C...^.JM*..-.d,..n..-..)`..L....J~....8...=...=........g.b3.....j...m ...w2.SO........U.>kSJo..G.q.M...-c;.;........X....RvT.uC.I....<37.e.X...A)...........<..)9..)........H.'\5..3.{8v... .$.t..i..xt.I.wEG...>...w......R."w....+.]..+.._......1r|..A..q....7tZ/...o..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\containers.json.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1119
                                                                                                                                                              Entropy (8bit):7.8397580095197865
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:eYwU8c4goQ5nj5/F5B51h0i6KZE83bkOEUre+:aUN/55n1tT51q0ZDU+
                                                                                                                                                              MD5:78DD5082F6BA9A5CAFD65131E9F50DDB
                                                                                                                                                              SHA1:68EBC909475F6F588DF515C0584C28FD3A803C83
                                                                                                                                                              SHA-256:8614A436382260103449ADA2A0B364B5CCEAC6E3AEF67778C7B6389E069BD7C1
                                                                                                                                                              SHA-512:8C1DA613E3CDB42F26F289AA27425766D1F074CAB61A951CC2A154BEA8D7FF72C5C39C8CE9651BC98C5CD82EDDAFD81FBA3ADAECF42FB937E63FE78591E01E1C
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:7.7[.fK...kFwE.#...L...Jc."`.j....>......,.n.Q.kcqMY[!.`.S~.......+.B...........N..4.|}.|.......B1N...C2..........:...U.d.v."...S.r"p......(.u.^........w...*..c...v+...8I^.`..:..=o5.=...9..SBV.....x.`~5.H9Q.s....."_Bp...6.yq...i..#.A...C.w./......}."...)/.g..K..k...%..1?..PFhy.l..v{.w..w.[.h..G..d6O.<;c~8Ty....O........=.G#_.Fq.%.Q.F...+....aW..5]B/W..u.A..T.3,.\(S........U.x+`./.....+..j..6.MV.8.=.......GO.p...C....*o.......|?_.n...q#U.K..(zr..3..f."A.>g.......G...;j..W.....rnT.........b^.D.q0I..... .....w.I.B..yc.....E.....F...\....Y5.a....i22]\.1....`.mO.&>kg....~.F.g....u.{....9.s....1'3.......'.L.-.AA..).t...K..)cWC......i..TN.^J..j.Q.g...........5...u.t?...6.6..Ko[Mc.....=.w.z"9...r.S..D..T.....}...7\..i~+B.~o..X7..a....e.u9;.u.}...Amh.V..6..w..;..K.[...!F~.M...[.}..<f._q........'..RH<..!C.3.p-.Y.J...~...i...)9..*..........8..tL...a.... .v.t..j..xw.I...4?L...~..6......Q.......e/F7=.......w....!..D..b4.Z...C.2.n..X.........wH

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):262394
                                                                                                                                                              Entropy (8bit):7.999389911579545
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:6144:ghrTSernA1CO5ISTEFL4btK4Op5n0lKAFb4:ghrTfnARwF0pK550J4
                                                                                                                                                              MD5:68164443170094AB3A94E3E67FF6ECCE
                                                                                                                                                              SHA1:312B9C8E7809E13B20D43D06F27DE6336BBE20E0
                                                                                                                                                              SHA-256:F53455A82D6CE9DFB08D8AC76356EDFDB51EB54CDC012FBE1811EE0DCE764C47
                                                                                                                                                              SHA-512:8ABB469E6F8061278102A3A0DA9847493089EB25F753FFA969B0BB201B8ABE35EBFD1177E5A8626670A2DFB5058DDD99B247AD717DA3BB20FBD4F8EE935584E3
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:(.U..b_.....Q......%.?HI..>.D....,b|X?..;z}W..$v.......6.r....h..T.q8...Y2Mc.....^...l..B..e.qc.:-[...$..x"............G].s............e~.|x.t.kP....b6....D_....."+.Lu.Y~Xg....VBc..Zy."...^.. ..]..MS{.d....$k<rM.Aec...,......^...a..^w.....v.j.u=....@.V9.X>xFTC..7._.&;..[D..gn)>p.+@...[...A.Pj.~.[....;...r...2.K$..lq.tE..P.....JMn`.)...1.MM;..........`..o..|z-..1......*tRh..pp......t}..h(...r..g.6.+..m.9.....\..,(...(...:.tu..E......T...:I..[v..mT..J....Y.A..T":.....?......UZm.'.....H.....k...)y}.y.D.....=... ..?. f.....J.P..l...g..t.z0..?.....F....]...A)..O...FiU...t.s..7T..!.s.<.]l..Z.d....#...e...V.....!k.j.2.H.tR8.#!EK..{.Z.]*>.B.H.CH.........-.O......X.....^L..Vg.[...w|.3.7[}..!............_'Vp.A2p..C'..B..3.....Fc.....g."....+.......h...~..&/........+O..b. .....%.\..'....'.F....$?(O...XuP..../.m5T.3v..%..c.....t`@..3 g.T..gF%wE...z_;.D..t..V....h.....f{..w.(*.......R...~5._'.W$.e._....JR.{l.k....0.d..#d..RZ...3a.c....u..F.C.!....Kd

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:OpenPGP Public Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):33016
                                                                                                                                                              Entropy (8bit):7.994578253887436
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:g104G7FH8dC5nVwas9dzLlYeGCB4EhWFSCt/OuPZawub/9Qon1:g1LG7FH8shY/zLRwvt/OIkZQM
                                                                                                                                                              MD5:D233C1C7FFCFB224D4FF8E344AEBB5CB
                                                                                                                                                              SHA1:1549D708227D8A6730DF8D695DE4E8FCB86183FE
                                                                                                                                                              SHA-256:CBEF2B0239C36FB58D7E092D7AA59C42009663ED81EC4B24E8EA8300AB68228C
                                                                                                                                                              SHA-512:1BAB6B65807B611776EBC3B2E57FEF85AB81FA195BE290054A76AE6CE2FAD3796C3C08F9376E8EEDE0D62270686745787ED092DD70C4CF9CD8EE32FF5453F4B7
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.<Z.K.<.,..M.)._9Dp.Mgm.h...}.ZT+.;_...Nu(u5l@....E}...?...... ...6..j..."rr..Y.:R....>kntn.a.7....X...a..\.v..\().........K..Nx#IQ....'>..H......bY..(....... C{0....o....V.?$...G/2..#..y.z.;.n.....g..{.V.:...3..6\..la.mQ...d.c.@.rgN..........=g..*"..K..|T(..svCz...A....o..I.C>.<.R.S.q6..p[q.....^.2...L(e.;uQ.}..r.....-.6[i......).'jx.i.t....4.WG...A..c....t....Z[.*y9.#...q..w I.A<..F.H[..;T._....../....I:.l.............icc...:../...l..T.....7....F......7..X..........\.. ..F....8..=...L.qD.A.R.2>............L.KT.jy.<....lJ{..F..UQY...Uy.vg....5V.6.]U..{p.....(..._..,.o}D.,....(......Q.t.7.9...e`..h..v.*}.D..E.b0.....*.k...;lm.x..O...fFG|H.e.'g....6..iV....n\.Q.E".!.......LS.Y.!...l..q$.GS../.CyO|........G`..J......f..n...Z.."...P.Q.\.r.w:..f..[+IX.@A.p...XOnR.5.J.....Ra..[.SV.'.w...NPRK.>.4&..f...b...pL..6X.d...g...pL"s.2....<.....y,..W.b..8i....q..{0`...k.(...Za..g.Sa..8./..Z.!...7t..-......I.^j.S.....lYp#............}.L.......`...g.

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):98545
                                                                                                                                                              Entropy (8bit):7.998129280361477
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:3Qg3KZ8Vp1PKFCnTuBorBzUujAmpQJpybfS0Pu:3QCKZepcUnTuYBzUuEmpQJpIm
                                                                                                                                                              MD5:FC253EC489EE38AB629197F178A42001
                                                                                                                                                              SHA1:59919BF6815377887B97D8FD2916C2EEC39289A2
                                                                                                                                                              SHA-256:C4564DEB7EEE5FD93ED7883DBC6E60F5A92968BD16A04CB63E2D5FA20F328DE1
                                                                                                                                                              SHA-512:EF878A817049C72607EF11E14B9CF6BC2792BECD5C75C069CF9AAAE7D65822A2C411794994BD99CB841BD3FE36FD7D0211D2E1C079B31545CF369B430D15DEB5
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.c.\.i..d[1-.............(.-.i.S/.j.o....:V(..oF%.Y.mE...,%7....p:..~.-1x.k.~..D..S.l..B.V8h......I..%e..3e...5.g.h........^..3..Q.n...'q..n.f...m.....U....PrC..H...hEw..dP(..]!.V.../....".,x.mR..H..M.m....DN.........iKs9.......^.W.Wlw.|...R^-....?.qVP...0v...c...#...Jv....r.l.F..i0...D.....J.M-.D.. .......l......"...F.....~z....`.9..b".H.t9.{....O.!.K....B}D.........^W7B(..@--....P.r...z#;.c...........R.E.j..F.... ..Y8.G.n.-Y..s......P...p...._...x3|.......".I..'ov...o.{f.."....j.4.....;...)M.....N.s._w....^e.....z.N........C4c..7.d.......j.g.R.'........W.n....(>..!P#.....f.Jm~8.L.9=.-..iP.....!p`.;.....yn...%.~A|..&e}=.........^...Xhn....?D......Cij.._.uwg.fR..#....uW._./[...2.a.....3..i......M................Uc.1.cddjd.*..l..>j.U.z..XG. ...._R...fuC10E{G.x.z.f..]...;..tX}m.%l.%.......4.w#......g../#..(..Cgc....&d.z.h......k*l........nb...4..C..K..e.^..;G.M..X.Nv..:..(.........?..-...A.....J.m..A....+..Q..8..8...w4.UB..OC{..r.{.K.U.

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\events\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829702.cde8135c-88c3-4c34-8670-7ef017742548.new-profile.jsonlz4.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4091
                                                                                                                                                              Entropy (8bit):7.9551605371722225
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:sAZD8v/lnAPTIQ5NKmFatLyx3trfMzVSK6gWvkjPgtWN/2jUN+:7o/pAPhGAfMzEKwvkjItWRKe+
                                                                                                                                                              MD5:C8F8BBC2F1C742CA991E3F82D7957DBE
                                                                                                                                                              SHA1:00FFD1B78265459B8D63FC972A966E1AC8410D22
                                                                                                                                                              SHA-256:2F08E2688950EF27E4168D65021D0230761DDB6F82C73D90FEC387EA94AD83B3
                                                                                                                                                              SHA-512:948DC74F8E3DD9EEBE376B669EC00F63FAC98CEFBFA0ABAE74A8BCAC86A8A4C72A0502930A1631E07D1E3C41286D036C2A034533CEB609E0E3D330C33E42CCA1
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:>....K[pT.1.p...2gp.u.B../..(.{.k..F~.F...N..../.....7......0...I'.A.....C5.h.cn.!.. gm.9_."H...l...1.@IZ=..~N3.L..w.....@l.1...V.a..Sc.`N...d...jmpH....`.pyk.vO..__..1....y,.....:.s8d...bz......_.oC..^|..~.....@......j.:H...\...`...i....pA:.u...u.jC....v.EL...a.B.+6&k+.@..D....n.B.=.\e.r.%.2...!..f..?dG7ea.=.../.i^.=Z.9...K*.z%.+...=.Y.+E^3{_.-.;u.{29\..L...?a.W............S.............C..#..&.N:.vf.'.KK...fk..f"(.4...]...a...,...!tc./.,d..(.l]:.....J.8..i..C..Fd..R.V......+...5/..h.vUgt.W.K.....S.E..3o..c.4..A...R..H@..bC...._h.....QW=;..rwQl.m..n2.7+x'.yi.g.+D...Z%..J9.....~..]..8R../..k...D?N6^.^.N..%..3U.r&+q.w.:.ia.`...-..6Bw....J....F.-..,$..v...B...Mr.1...P..Ir....2s.7..S..&vFf/...7.n...#...m-.g.<...k....B..;..O.+.V.,2...,.]xq.G.v^.0.Fn....me.*....................1=.W.ym....4.(.r ....O.6.B..DSL.V.......*.C.....T.W.....e...ui5.4.T..Z...@m"2.AT...'.m7^..%..2:.W......|~X[...[E...y...oe....Q.r.o.0P=...=...U"....\#...m.........S..{.w..e.D

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829737.9f7a5e7a-2be0-4ff7-b132-b1f6e59a8e58.event.jsonlz4.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4441
                                                                                                                                                              Entropy (8bit):7.9558501999211
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:H2jVW/4htuUfOKnn2avdLfsoSFHjSZsi5zsNaR18qLtmf2FgB+:2GET24aGd5zesmq5mfV+
                                                                                                                                                              MD5:2569156FFD456E45F26ED88BFEADA1D1
                                                                                                                                                              SHA1:6025FB9A0E37DD415621813D5F4762525BEF6EAA
                                                                                                                                                              SHA-256:B3C3F9689E6B87854BD4358B7F18EE14AFB386DCE8A1247E584611B199BB5085
                                                                                                                                                              SHA-512:BD81DD115F22986B689F18CFBE822C1F8898DADB3DE0F862093641DC2EB068C6A5AD0EC9DCDE708173179E5734FA8A6A646F90F51F9AE9E0EF48F98ABB4E68CC
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..K.Q...6s....N..B@..*{...n?5."...... ..W..>.-&.'*.... .+8.....Q.H.+.u.XZ.@B+...74...mYt........!.:....UH....p..jx!.u...[.[..r..Z...._....b..'-...I..%.95...n..jJ.%^3%....m.#.@....\...@..n..qr...z..|.b....A..@.;+5..:....V...S"..L..gh.(..OT...-.mh..x..3..dJ......}...O,>..<..7.&..}..v...u......t.s.%.nB.\...R............s...r\..p....Z....,@x./,-yXB..:......|.ZR.e$.H.#L.t...>.r=.|l...x..5..u...Z.....:3.zTs,...&>.B....Z.#.+..]...Y.6.[-z.O9.Gn.4..-....W.01>....9p..LUm..mV.....dL..[..?<H...T.......e....ud.."...!#..p|.s..68...sg.!.W..B...K.b}Z....Y.2.......%@]....CO+...l..L.9..._%]...\..J..K..%/..T..`...a1.&..e...T....B...].....:...P.Z.&..8..5"6Ns.e.....=.:...\$../....c.L.t4.-.j.N.B..!3W......+B@...p....`.:..k..Dh.qm.....0.F..<X.Y,F.. .A.SAoh.t..E...d+"*...3PJ......o.QI...i..A.kO...F..<..x..W9....I$...X.P.@.I.f.vo.v.).~ .G.....$$C..#/,t..;...E..b}{.f......z...&....P..0.....%. C.D..q.H.#.}...D.....mZ..$2..f.$}..G...u.E..=+.....X?..S.........Y.

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829744.7278f154-e8f4-4235-84c5-c5c1c6af0084.main.jsonlz4.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):18586
                                                                                                                                                              Entropy (8bit):7.99120527429265
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:384:dhw5Jv4fkj6AwgVBUlHFiUemI9SsqGtmDSAR+G45e72Z+:nwzpj6AwgVBUviRmIL/JG4Er
                                                                                                                                                              MD5:1ABC83F5EDE53370E739FB7D88C2721A
                                                                                                                                                              SHA1:4D570DB63A983C98E4A633AE98DE91D1B7BE9CEE
                                                                                                                                                              SHA-256:9C3657F84EC7A931364F0D47C9A64A80FAC8EBAA787EA2F958CF59AD6076A0C1
                                                                                                                                                              SHA-512:8156C34B0951B104F93B849C64333B767B14C00013AC5AFB14A48D7F0202C69C9C1A95F40976986701A2D37D5562B6DC4D48C321F2BD22C8700DD0CA7DD3B3F6
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..G.~z.*..p..[>..)......| .uh5S..`P..EP...S..R....._....#.]'u..g.t.J.da.{.=.@$......v...n....|....Q5...A.6O.../g.,...<UR.....S'....FS..I.(m\AX..7R.N..Q0q.O...4.=..{^=....9.8....2;...lV;m...e...W.g..q.....Ps.V..i{....N+...A.>n.....o....`.L..kC.Zpx..j+.......b.w.8.v.>...t...C..W0.k.... .h.S....c.+.....!............T.... S.i.B..*..1.:.......k.5.....S.s2.[.d.l..J.....V.J.\.n.4...lr.W....&...Ya-.....n7.(...m.....%J^...,.._.m......Z.v@.....r.Qf..O...7.E\......,...#=VL<...B.w*..._y.....yM.Ge.4....8....6<s....>...q(a....K.......:..x... ...,..U.mG>..Pz.c..aC.......8P.g..c.gJ....(.O...e..........e.9.V.a..a.^.......!.~....<.p.]v....j.A.].hk<.b.l....Z.?...?..m.c.x.C5..Q...^..".....F.j:|..N.}.....Y(0......5.. .?...../..f.#h.F.Egt.Ud..H............A.k..r.pC...^...."U...xl,...u~I...'.j6..%..wJ.F...Pk.o......;.%.U.ok.c....-..H.........e...F:~...p...|.^..$N-......y_.1!.A...W_...W..z...z..%.)n.iF..+y+t.3.J]7KV..[.o..%.....~..)..mW...n.. .,...kI.+.......N

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829746.67aa4432-87f8-463e-b422-f6679add9971.first-shutdown.jsonlz4.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):18597
                                                                                                                                                              Entropy (8bit):7.988596298288619
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:zfWpZiLk2reIXHRaiVFxA6AswG1zi7l020quswlzsgnsE4yA8k+:zf6ZqeI3sim6rz1LvFzsgnsbL8f
                                                                                                                                                              MD5:E88DD01C7BB86AE73AF8C0AF0AA3867D
                                                                                                                                                              SHA1:FC522BA6BC1344B3F3B6D6A878222B285CC6FA3B
                                                                                                                                                              SHA-256:FCE43DF5FA530FEC1D6C21CD9C2357F31CA21152B596EE4B79A45F7B99AC586A
                                                                                                                                                              SHA-512:808EA1A63A3D89AE621879297D3E94FB1197F63EB99F24B44CC56750F5B8933EDFD5FF5CFD1FDB5B044BC6E48F7786999878EA6423F783A646C944018412DCC5
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:(?.",...~...u."A[pS..+...}.-.%Ke....+}%.G#.C.UmE../.:B..a?icXGPs-.......o....35k.e.....J..!..".,.....nR%.ug8p....9..1.."'.kRj.M.9H......]=.....+...*.6..dC..G.....g..h....h.....V...Mq~..Z......ne...D..........(.'.:.b<.,..n.J.......bj>X,..\j....\..o.,.....w.?...P..H.j.j1..P.1]...U...........n.z...C..~....?.}.I).[5$..*K...u&..M...3.,.L...Zn.f...b1.D..... ..r^..9.O#J.....c.wV\...e...h...[..#.p.4.q<...|/.j....Shf......~e.?.......,d.'.....U..y....n.s.T.....&.b.I...?...-k..f\t.I.N..........k..#.Q,uvq6.X.b....u.....p.x..q...f....:...S1........} )...G\......04O..d..%_,....].RK..v.}.......]...n2r}j8.%..!...!......*YR4....}.f.Q&|J...}",..NX.UO\-.K.....T..).ES^1..Q..H.....[.....c.9..c.U?o.).S.j.>..km.48..G..\..|2%}.-0.t..<.Vd-Ei.Q.D..7...`u.i.e..hc.^\...@.-.6r.6.MH..H.. ...E.i.l.......B._.-..|.....6.AQL@.z..P..#s"..et..61.^G._..\..H .f..i..Qw.M....J.awq...s..,...K8..ha.<..D,..6].E.%..\.+C..0.WY....'%>u..0....s.%8......."0I. ...L._'.X[....Kq.raS....5........~

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834580.6fc53411-ad83-4cf6-a5f6-905f0f3f52e8.health.jsonlz4.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):746
                                                                                                                                                              Entropy (8bit):7.750980194473506
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:CxzJMi3kCuLzq0LmQE5wnJRBMOPPu2pzAdUMS3O:yJM5Lm0kUfPPu0z6UV+
                                                                                                                                                              MD5:8B995EFFFA030420D8BFEC8FE5CD1E71
                                                                                                                                                              SHA1:FDB20AAC624FDD4739040AF9A8641595C4559656
                                                                                                                                                              SHA-256:66FF162174763E9DD5F89E0FFD0B85667C0F156F44B72FDAC72D15F20CD17EDA
                                                                                                                                                              SHA-512:CB2CA9E89D6F7B9D8A9395D6A523CF5C54FCA4806B611CD8E6D56E82FC3A79B02189959A3FBDE3E71B8262AFDD06C3A3822C2C76F01AD82B2468893EC9E5257C
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:B.......%v.?....5<$X...|V...@v.@..+..n[.*{.+..&.x..,(..........Z.ZSO...z..2.....Q..9......].Y..a........khy.#...V.6.d.:.z.gi._.bt..{.}....i.>.......&.....NhI.8!z.aA....C...7Tsz.F.....0..[FP..n...7...++.Jt..:.`....?....9.....,..i=.....l..@...fDh....Y.......3.s.*Zi.^..OHH{0....^=_.V&..j.mL.j..D..`.....k.......v@....r...DOv.e......!...U]#OZ+...xCV.'....Kt...0..iI.3...1..;.....A..!$.V......w...x........V..K.I..}B..{9..}.z`...&...{..T@...`....E....wL..EB..%}X.3..'b......F.l.|'!&..*<u0.~"0.:K....7.|{@.:t.....l..*NRc......e...:..gt....+TVh.1.H....B.Q./Suu. .i..C+.J2a...1,8....X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834606.011115ff-9301-40fc-805e-ba07b7fdfce4.event.jsonlz4.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4445
                                                                                                                                                              Entropy (8bit):7.957965536422892
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:pYKbyyHHeV2USZztFNJFBiUqhwIVzlfTiKrpLXkI+t+:pYKmyH+V+Nt1FVIVpfvrx8+
                                                                                                                                                              MD5:27E1A56348F838649136B3EC0C785CC1
                                                                                                                                                              SHA1:B3959C261AECC85AFD2D4A17E164BF147C2D740D
                                                                                                                                                              SHA-256:84B42E220AD4F7B2F14BAC88A5FF13C61A76F419EAC41ED603E83DCE422932D9
                                                                                                                                                              SHA-512:A0B9542E2D1E44A38F75D888D28560B43F2B923516D9395645BBD4B44F7DF38761DB5C77F6E64FB99959F65C678D92AA396753B374A702455A27FA1170A3CCA4
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..5v]..W....z.4...x.p.6 t{3YA.TL.-.5].].a.P....Z....`.A3.7l.......F..m.""......b.KW..$..:x...0.l.0..2...lD..C..,...~3..^.:.....S.B.3..,..:...s...C.t.O.R....E.-F.....^.t6....,a.50...b....1.c.........#....dM....~...V"................I..UWG..*..NY..."`..5...KM..I4..}zoy.QO"~e../.Yq.`r..F,.._[.Fz..+Dk`......*0%.-.P.'8........._.l.:..i..q{.H.g..d:S..%.&M;...^....\...\2bx....s..UC.\n$.....].;....S;........e.5...fJ9f..@U.\.&^.#..=....Z....D1.1..$..u..W...;..;.r......p....g..e...d..d...^at..1...;.........oIz1hr.U.....-...._....CqY.JQu...!s...qU.s....[W......./...e.[....W..%]..+......m.B...e`..m..57...98....8k....s}~....)+..W8RP....j.QD*..L./w)... q.........C?.......6%.4.........#.|..br..##..[&sd4...x.@.|...n....^...rE(...1p].^....R-ml!...)....m^.3.).xw.9.@...9h.6c..M*.9Be.0.#%G....,..&..vu........%.Y.....>..6.......S........:Du*.n..nhu....UE.[H]i.......<32....n....O.....6.U+.uWZ....v....g.+N2.D...Y.u....vc..M......A...k. R.+...jA...Tf.....k...mSTi.ql.Q

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834608.65054280-9d54-477d-a3ea-afcb1f88e001.health.jsonlz4.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):745
                                                                                                                                                              Entropy (8bit):7.698072633203105
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:LRl/VwyW10ZhXrxSHM28ouugkXBFBIeok+Yw2E8xRS3O:Liyx3qgYBwel+RnD+
                                                                                                                                                              MD5:22358F4376BD9A06D9C1CAEF575504D6
                                                                                                                                                              SHA1:B8253511CEA2DF6536957205EE9AA4373C27DA67
                                                                                                                                                              SHA-256:EDD8578B2D8D0EFBD07C150AD31F031A32C95D3C236D3E475417ABC3900DD852
                                                                                                                                                              SHA-512:3F844BCEB9236C8F2754C369123B2D8A8A453C50E1D044C9926CDA6DB890BAD3CAB51626A7A58E0ED553664AA85C4FF07341B83548E9973F5AC1DE9FE8C36A9F
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.a.....cy|W..C......R)...L.*.PuQ.K(........3....t.k...F.y._d....`._....j.....q\...+.X.E...1u7>>.Q.....?/].&...=.eQT*.B..9.._t2.......T......(..I.1M.......a..y.IHb$./!g\.L....8.DdE...'.d.!+2.....:.O.....2.U\.4..G..ip|..u2......o.p...S..l..5..ew_......*..O.f[)....}.0D.....m.........3N..).....!8.|.....'....a..x.yo..*w..|cQx.b..gs...N...Hd...[.qHo`.KU....&A5v....6..<..i.......zH...iD.W.fU....NC...N....]...]y..yc`..]......{9..}.z`...~..et<L3..yQU...u.4U....g......}Mgs..WH`..*.."....U=...*<.0.~.0/vK..H.7.|{@.:t.....l..*N.!.:....jg.duu7s@.......(..-......2{....Uy..#=.I3...*.>.Jt.I...X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834620.c7889da7-33f0-4599-8452-58d47c58437b.main.jsonlz4.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):15376
                                                                                                                                                              Entropy (8bit):7.986616849667718
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:qDRgREnWE66X3012xBjvcxyKXyB8BB1nxZ08878mcdin7Ad6C+:qDi+n46X3012P8jYkB1xq8BOQO
                                                                                                                                                              MD5:12FD071A9B9FB8C59FE835A559EB4B16
                                                                                                                                                              SHA1:4C637CEEB19B809A45206E9FACE27150EA984161
                                                                                                                                                              SHA-256:918DF97DB9BA2859F642807860F4511C2C42B2F50FC9EFF5D10F8941D0774551
                                                                                                                                                              SHA-512:E4B4993BDCEA4B9F1883DB2EE31487D77CA12F55DF6534F574AAA52B6357E4AFCD361C72C4509CF19205C749FECFB017B7EA1B6AC5A52BFEDDFFE7E5170761AC
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..E.U.1.L....x..qg.SD.......Bg......F.o..T...B,)....:...../..=.@p.Q...q..xP....\RY.....=4....SA..I._z.)...+g,.f..6..V9..g..q.y..%jms*?....A.B..g@.$.}.w...A/.n.f.........Q.i-...lM(1.-.C....)?...:a......#..O..N.K.0u`.#fDc..........T.....7M-f..\...l...m.Ou...'.'.-.#....u..rG.._~9....|t....t.-u....Z................1..a....BZ.T.6.w.E.s.\.~....6YE...y..>l...z4......./.\...LW}0.8p....'K....`........(eQ.ska.'.?.'.)'.A0.1....N.G...4.b......Bey....m.z..X....Xg...46.U..E......z%Q$.....es9..:.I1s....`..u(..%..."]]..@@4.+.c.....].S.v.Em.........'H...c.r...1F._6P.o....!&X4._t.7.......n.&...|..5...>....V.+.G..P3y..$......s...g.....,zk....v.gr!..Z..Y}..vhn........c.d\..Q..`.pw.....i.c...y...X}".?1}6..N.,..P.r.....R.d...m..f;...&,NO>..@.7..c5..4./.....y]a...":+.x...:..HB..d..g.r~:..,...l.yh..........h.[.}..N../R...A.K0.zp...{....3.?.......a.Cn.......;]@L.^.....q...5.ci.'..hF..|M.~..\p.bU.?.....Mt|hW..z..;.H#..#.....|?.<u........._...,.....N...X^...s_.f

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857833.45e26519-596d-41a5-b290-e547b44111fd.health.jsonlz4.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):749
                                                                                                                                                              Entropy (8bit):7.725294021525653
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:69kv+XgOxG5UK9G/JmIXJtWFIUd1rDN5Vl29ujV+rD0UI4CBuAEdt3O:GngOkKKOJf5kD1rD32kvACYAwt+
                                                                                                                                                              MD5:14F63F18F30EA9753A91596F302AFA95
                                                                                                                                                              SHA1:5FA96B81C5CFA2792B527402E552F6120CF9DDA7
                                                                                                                                                              SHA-256:10D9CE6EDCBE4A818474EB6F57B39DA8B152E65568CCBEEB628BC76B9DADA08F
                                                                                                                                                              SHA-512:4D297D2241EC7FB8E0B7B0EC6D10417135FB80A0816C126F5FC3E3EAD8AD60591BBB76BEB04AB9D94A3BE545824D5A1481FD47BF84403B017D9D22853FA49ED3
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:%.......9..=...T.?;...P?~.P.<.p..zT.....m.."D)].U.._Q...V0.}..B..P.{...q.....!q...a.#....].(HG:^Qn.u.ia....S8,R.....2A.. -...;b.....z...u..I..[.r..O.s.....d.;w/+.b[ue....u&`.P.J. .8..DAJ{.z.....t.6.-.S6.,.Ak.bwS..Xh6]..Z.}.w.~.uM,I......JG.sXX.K.)W.%M.Vk..k.....z.9.+....J..i...D.._.0..4.2\s`9;..V^.....g.e....`.%. .ku..K;.V........1...[._A.7jT.F....a3......amR{.......a...m.uZ....FDg.{..C.{.8..?.....F...4.40..trYkq..$}.H{9..}.z`.......G.+M;m.yQI...m.4.X...]...U.+U..1......>.z%..AXY..N....a#.n).b81.9.....`.|{..:t.....l..*N..X..ySY$M.W.L.....=.K.O.MJ.o......v.n"%O<..gC..#n.BX.".9T.t,...X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857860.81ddb4cc-1d49-45f2-961f-e24ea6db2be5.health.jsonlz4.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):748
                                                                                                                                                              Entropy (8bit):7.744433536537098
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:dSCc70dmm4iLID6w/I9K4WNS/aNaogQ/S2RQLZHgmyFFafp83O:jc7Ydv26w/I9K/zIEyLZH/ji+
                                                                                                                                                              MD5:04E7F2DD054D4AF88405C8B912092B30
                                                                                                                                                              SHA1:3044628200A2588000B9B715DFE463D8CA953914
                                                                                                                                                              SHA-256:AAC5A26115585EF7A1A8A681EAC4EFA2F8F10D725636BE3A415F72D9B9F8628C
                                                                                                                                                              SHA-512:8AF148F468ED4CCE94021DD7423FEEFB0DEAA75B643289EBBC80E152B0901D3B99F24A0D508C196CEBB230E3A824E40146B913EDE3ECB03C7A1563F9BCDBCADC
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..S.dh..$h,...).}O.....e.~/v~..+t9.........gt$M....2../uo..`C.3...D...eM..6.[.HK.%3.i;:V..%....n.?.._..0...j...+.e7...gf...9..2..y..^Q....]..y..`;S.4..hs.#P...~`.{..vv.M..9.D.X...=b"\.....=.B.......&+ar...E...T..E..|..N}........<.....a..+A.\.....$-..i3..u..p*ME .Y.#.&.r.wk.......(_..P.{..z|.@RYn.....g\...y.`mO.+...z5.4r3.WM....(..t..W...L3..v....N...}..N.)'Z.S.)..n...f.kV..x..).U&.dk)..H.P=.3x...i..)X.....K..RS`H..I....1D.{9..}.z`.......k..W7!.qf....C.....d...@.]]I.........*....U...[9..a#nn).b.1.9...+.`.|{..:t.....l..*N..-V..'3....|;*.K'..Dm...s....z.T...(...x...:......q.......e f...X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857860.a73949a2-5a70-4025-8008-88156c16bb4a.event.jsonlz4.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4447
                                                                                                                                                              Entropy (8bit):7.96189251038644
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:2vllgsQaGkrVNEV22meEPyEaVMax8/gUdnxlaFBxmzzFev+:SllUzYbEVLmeKyEox8plaGz8v+
                                                                                                                                                              MD5:6EB73556345ACCC9A4E5D5E98429B9FF
                                                                                                                                                              SHA1:4348AA21E555FAAD699FCFA980F74FF698733D2C
                                                                                                                                                              SHA-256:80E582F78D0AFA3DBE0FEEE8364F2B5F927448A0E400485113295CFA6AB26217
                                                                                                                                                              SHA-512:CBFF3686A4081C05B57A9DB6C6466E165B809FFDCF3BD4F6C4B2401DE4448BFDF397FBF7C5804D654F7988C18F5F832ACDE430088AD2A8898E014B04FFFA2EA2
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:{fS.9v.8.O........3>.P.....K...uQ..)h..l.....\....y....'...p.!.d..O(...A..c..x3..}...:.e.#.rI.5.ep._.1...Z.@..v..$..0.g.q.Z.06+....G2k..._.'.}.#-...|..g%?k..$A.S....=..g1N.....I..J.G."...q-...snX..}.~....@._..(..t.M..<%.I.\f....E.Rp..H.N....ls..T.m2Ipj..2T.b..R ....3.....Q....D;.s.]X.Z.l".w....QR...Nqj.O..$N...D.Z..+.t.].......[?..4.9.t..1y..F..........h.p.wt....7..mk.%.+..d...2.&....>.L.+.... F.%.=..+B.M.Y.E..61....w.......P..iq.r...W...N.d.x\...7E..JW1..3W..'W&w.)...l.....n....JZ.....U.........~..c...a.Y.."*f.........:U>..m...........e..G5_.}0......C.W. C..U.hHgo..)..'..(x}.$N...6.\?.3.HpQeE.NQ..FG...i.r...b24..Q.j..$..,}<T.O+..%a..!.p)...)hV.jKU3.&...../q..JEZb.z..L.\d.S.....&.....`..?n..+......(.UF.\AR.jg......*.".Kh.......~.C.......=....B..5R.....n..O....V..@x..]Cg./.v.9'Iirv.9....^.w;......5......X...<.....h.w?i..C...@qJS.PF..]....e.:..&3X2../.).0$....N.7Y fy..|..^L............r.Gb9...e.D...U.C.Y....{.>.....V1.8J.-..([a2P....(rcn.A

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857869.95af30ae-acac-4802-b983-233d7fd3cf34.main.jsonlz4.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):14323
                                                                                                                                                              Entropy (8bit):7.988133072891469
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:+J7kLHuDA6PvCurhwqcfgYbyDldHcVVe4J+:YILHExrZcfnb2dycF
                                                                                                                                                              MD5:D0CB477745730672B52DD1F415DFAE7D
                                                                                                                                                              SHA1:C086973C5B90440C7F247FEEB6254A617BACA3B7
                                                                                                                                                              SHA-256:91217F31EF54ED9D580BB523BEC8251E3159EC8B7BFD19FBED6065301E8F3D3C
                                                                                                                                                              SHA-512:165B992CE9FC5E7B4C3041D1D75FD5A8EEA7219BB7466A537BAB6813EBE531224F1ABD1CE3C20B9595C56DF853EFB0F5C0A94B83AE110B96126261AE9FD990D2
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:_Y.m=._...\.f?.w.c.............1.%..cY....l...8.2|x"..-/..c..H..rmz._:...n...\...C?d.4........3....u..R.s..iF4"!5c....0.W.l_.Ma.....GB.$....G.4........Bm.z.{...w.~.s``..|.}H.........}v..K.D.xi..k..pq.@..obQ......X.l.U.].....".:g) ...'8t./....&$..]..M^7.1#^'.mY.....y.$,...o....zP.G0...7n...O.,...w.nU.@..^..#.~...3..4..4......zu.8..%.Y/.._.n.l.XMK>..?.x.Y....v.T.4.v.e.N.w....r.n.......@..i0L...u...YUOxD.D(..9V....r......:!...v....8@.z.F.#.}.....t./.yRz.G$.e...=."w./.]|.tH.F..,..N@...e..E/..H......-..^...."m.n....~.v.{.9..>......x.V......o+.1..v..;.o.#.+.>Ei....4.H..H.........V..D...Y...)K...R......PI.~X...r.!......%......Q+....|...;N.$......a.E......b.*....V.)......o:.1.T......uA5.K9T1..L.[.v.K9....l-.x.....z*S....V.....L...xd.'.0r....q]/.!m....o..(Y..'......0.....d..@.+c........A..z.H.x.=...F.Va...N].RIh....b...[9.......h.?..Z.../f...L.i.6..i....^!....H.....4.o$Hz^2...*....-[.A...p...H.2....L..TBp...qB...#.!..oCi@......@.^.y..p...j.x

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\background-update.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):700
                                                                                                                                                              Entropy (8bit):7.71882239225404
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:Za1Vf3MHSbnlUrf8Xn3aCX7IZHQV7g2FhqEhvyg35vjc3O:ZadnlLaCX0ZHQVc2FhJhvyghjc+
                                                                                                                                                              MD5:818B1E0063291E1BA17D329A14B23F96
                                                                                                                                                              SHA1:9BBFDED86F82EC205EC7122F2F7BEA282024F568
                                                                                                                                                              SHA-256:76A1ABB8CF8A12A5484676AC98A6014E7D827A1B95029BCFA037F89D3DDDF290
                                                                                                                                                              SHA-512:9E831E952EA3CEC849F54A90954BBB97C951BA9429E6EA72067568F8879F0CB1A6DD0678065A4B34EE94129E3CFA555E504B4E89016390CF6344EE5336A0BFCA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:...K8...L.V....P...W..j8.a...(.. Pxzs......=.,Vo.t.~.].DT..<.J.!|q.&M;..0....U....%.6.y.o._............}.o....9'Z6=.......W.z.;3..9..SJ..P.8.4.+...^.....i..UQs.$...........<.x..Z...{.!....K].d>E.U!~.V.0.....Y....0<..G..)..%.L?D./.j.*.WW.........nu[v....@.....^.G<$...._0...dl|)."r...u..*.i...........7...A|....{.......)..GAh..T]ih.5.P...............!.VR._"....|..Mx"..J.....s;5...u.d....W.....A...1.<..,.T......BXq...-...;..u..mX=..(9..'........`..T...W.,."n$.t..i..xt.I.w>...#..WBFZZMm.S.)ak..p.....z......g....X..".R]f.f-.!....+..`.'.T.[.s..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\events.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):755
                                                                                                                                                              Entropy (8bit):7.726046045783057
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:9PEXW0iacaeoBOS6faDFv1+sQcO12Naemy4lPelHU3O:NMiBsOdAFHhbm6l0+
                                                                                                                                                              MD5:B0B736927889D7092D43EE6A9DDA9F83
                                                                                                                                                              SHA1:4266A6B892EAEACF86F32CFEE37D8D47BFA0C2C6
                                                                                                                                                              SHA-256:DDB1C7E5FD5C8FDBE82C1BB442A06D0E8CEAC7B36C8D2517F8BF0591B57CE72F
                                                                                                                                                              SHA-512:222C35E8B817E8373AC92620367A5CAFD9E05415096B87013416A24E24597F41BD38BFB79B69E38D6198ECE841202E7FC58975E752BC235A1645BA2FAC4D0F0E
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:Kr.CZ....#Tc.RrHP.K.x.%n4..n.....D=?dn.....#...)3k3..H.n&..9..u."O4...Ap".#.......j.oe_3.b)..V.7l.ZP&...bwf...^.r.D..:fi1...fl._..P.(|ajS......+J.....j..b..T...-...xP.......3.2.<.....[.t..l.....yz.o...eh!!8...g{..,.x.1.!O..l.;."ML!(-.6|..<].!jq.4...P~...8..9.xU....O..A...$...4..F..C].$1..z.G.X=vqV..V.Cp..^...1z....Z.32.Q.X.....I&..846V....p.,cw....P3.P.?.7@..3v.....vQ....K .R...!..'.`.....TB..Xv.;36..<+..%......-s^.u #|V..NFU....V............8y.S3...nt...#.d..`....WY."t.%.$.cW....r._+.........z.....@.K]./9...1.U.n.=....K.-y&...ct... ...r..V./N?..Gu.Z....>.....F,|...D.M....1?......G..........l(j`..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\05d02ac8-b2f1-4670-8541-db8ec2bbf427.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1950
                                                                                                                                                              Entropy (8bit):7.915885201812725
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:BqlSRp72BuFMpPZlLZdXXipcQpOThdrS/YsTPY+:By2paQF2XDTHrS/YsTPY+
                                                                                                                                                              MD5:56B00DDFD40322609275D012C683FBDD
                                                                                                                                                              SHA1:1C4231EF4168A295AFDA9F6538C7D63851E922BA
                                                                                                                                                              SHA-256:B6DAF6B453E94C52B88C1CA5D19070A866C52D3A128873E04C4A7F0EAB92C522
                                                                                                                                                              SHA-512:98E15FD70C214E7F1C591261018E1511CC6603B667F1AE0C70A1539A5C24B27AB1185460BC6B474470CFD7DA46B1CB9B2C9AA89B7CFEEE2E0ACE259766C4B3A3
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..7.!.E..-.....bW_Q.g...'.1..J....L.s...V.....I.+2+.@#..a.....VZ..$...;.1.'.)p.V7....`...n&.Z.i_.Rg.p....W.v9.Y.(t).,..h.Mi.M"....."s..K...r.u.......X..S.WO.7...Y.F%r.5...}w....^|s.....T.g*I.e.....d%.b..0....t...W.V._?.QWE.'8..n63^."?.C.....2......UQ.xa.._A)...S.U%.S5p....F..............5..L ...a.y..|.V....u(F..T..\...l....Ke.]b...2.Z..?.%. ...~.S....q........s.+.c.....H.B:.)...LhSd...W1.#.b..1.k...(....Cq..h.[..mO5[..a....]6....4.T!..A..9$.x..K..%Z.o...R..>7.-,.N.+s.S.;j..9....dt....?#e..vQ....T...<AE.J...N\w..}.F.nK..e.SE+...R!o.x;7l.....5(....N8..t..m...4)~.f.n.Xzg...H/.8....Z.:..,..yy8>.V5$.(.eJ..#y..{......,lW........!.+Y2....t.Xe....&...Bw'....6.6.....g..t+..."..........k....M?.Q.|...k.....}.j....J.."....z.c..5.:.{....~nQ'!.....THO....R..#R.Bp.v'..#j63....0i.q.W..s.`+S.-\..80B...O........5Z%.k.k.......K..b...........c..R5?....{.gq......CU..:V..s.......N..^.7.~.(...\.E.....)..V..*.X.....<..E,."..o>-..9)..7W........J.)3.

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\12f997af-c065-4562-b9f6-11000bb95c9b.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1579
                                                                                                                                                              Entropy (8bit):7.874768532566073
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:yIf5etBWNZ5t66XuYA5Wyl4eY3cKWN5ZD1AU6IvN7cfLt9L98O2KMPQhwpKE6+:yA5et8kYuYM7v0cPN5Z96OGtt9FwkE6+
                                                                                                                                                              MD5:74797DC3700561F160BDD5CE256EB5B8
                                                                                                                                                              SHA1:7FC83D379932001BF49AC097318B34ECE9B49A44
                                                                                                                                                              SHA-256:EE8D876F2F13AEFD09C8569A26271E494F17619C04F2AD213C4395EB790D707A
                                                                                                                                                              SHA-512:DFD59A70D96546F958E9BD62705BD3B35761066550FE0594D03FEE5950E7A6305A1D8E81FE49D2FEEE1FED4744C3F4CCA7012727BBFA690A44302053053C14A6
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..`_~.o.aT...{....-.Y-Q.mV.......vE.wk/.W....j...A..Nf3..b.?`...F;......AU.3.i..."...#.q....U..SK..+.z.`os.JX.`f.I....H'".\...%..b.".|v..?....s..c..rG........r...8v/7.b..R/..p...<V...."...(.9..@...l..8..L?m.b.e.l.D.~...3.. .4..2..+(.......5.[.\Q.._..z.......O+.^....F./.<..`.9..O..du.F...)-e..e..R(.@....! .%z..4LX|....|sU..a.....e.@....}.....A./B6\..r..n...k....&.H.!...._&jMQ.....m'}/.D&..1.[yp.e....z..h_#.(.Z.N:A.t.....{U0.&.,0..=?..,.,r..<............\*]....L..{flq...g6:..Ih...n....... .e.d.>qp...D.H.2P...Q?b..:I8+'..B..@.......3.T..}f.../....7.y...`..E.Vh:.v..9..... ok.h.rE....lj.....gD.<......I.1:...../5...^...}.[.......x.X{/.~.97....1..e..i....?..*G/...n..z....M.T&.%5.:Z....!.....$.g.;....AM....2.}.e....1,3.[.".-A..]0....Z.8.(t.IE....,K...P...).t..%.T..b..V"..T.]..E...!.[.Z.}704....\<.\..Rv.).c.9t"LH..XH.<.l..o.!...Tj..3...h........%...5.)...}B...z.c........9n..#...C"..-...w_.kC.YDs..l.B..b~%.....LA...j`...&..(w.}$.s.X.v9..Dk.D.......

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\1435a377-bbaf-4c9c-8706-0811a779fa3f.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1946
                                                                                                                                                              Entropy (8bit):7.901158078327384
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:lsO/qYFkgA3Z3lj01Vv7AF2Q7HCO1/I0OMxWaDHD8wisQE4dD+:SO/9FkgA3z01Vv0D/1/IMxWaD42Y+
                                                                                                                                                              MD5:C6FD4D582CE815878AC9AFB223EB32CE
                                                                                                                                                              SHA1:D2ABBF36F0C3ADD1D41CD885D8B24F3744C10242
                                                                                                                                                              SHA-256:9B0AC3018A6A8CF0181C81508C12054B8DF26D461B5B319E8791E4C4FEE914D2
                                                                                                                                                              SHA-512:73B81D6F405B3E98F27CFF23B385CD52B3B8F2E2477F8D302F26ABC01C02BCE43F02760B9D67972854154307E1E1C3E3A90321369F04B08A2A8E70ACF4467FBF
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.(Z..?..$.14ft].3$...4.My.4Q..Y..F.\..><].6....o.....Y.......-.b...Ft...i.L~.GU......r....g.Q...8..y....R..u.'P./. .*yS#@p.C{.:.<...S..A].&...a.#...2.}*..U.g.._\...x...&..;A...a.....O.w....x..n.Okg....Waq..ZO.+....]Y5.U..!V.z.G[.s..D.Z!......Gz.....r`.,.-....P.Y......|.ZG.x..."..T..B.*..S....x...u...(5c..).r.+/.).N.G."`u....2....].v.........iR.p....h........X../.l._.y.J.....h.D..3.n..t.NEcY^~..AX..n...b..x=..C......0Wz.0..f.aFDH.,CDh...s'.._=.:.bK.....B.42lY..vJ./.....T^.F...}W.;....Gg.O.<<..?N#.'f..F...I..T...6."...q...I.+..-m........#..t.2...Y.i>M....t..p..F...np."...&.F.....'%.U .......7*...:*....eV4..@...zx\a...H.....6.q.".l.....6..........eJD1.E.jI......A.K..x...T.:&E.n..'m.6S.^p......Z....x../.Myw.\o...J......(.sc.r...`...F..)P.._..p...q.S5..W.....~.L.=.Hn..o............B.%f^&./).........NX.*...;.G.6..'.O!....:.U.. ......I..C..8d'...\...!.h<....Q=.O.0.B.....(......hg....1+~..m&..k.5...,V..].E.........~...~#......).e.GP..&.....

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\15f01145-7764-450b-9ad5-323693350a9c.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1582
                                                                                                                                                              Entropy (8bit):7.881878897495084
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:hLaOiaELk8z8Ny6QhAV+t4Fpiolj68/lbdbxZOw0b+De8PsqjWCNFO2V8b16QFv+:hLaNiy6QyddNRhDIxOEk9QFv+
                                                                                                                                                              MD5:6683639D7470DC43CADD9560C14999CF
                                                                                                                                                              SHA1:48FCF76660143FE85DEF736151CC7CDC4600436A
                                                                                                                                                              SHA-256:B239F5C6D3B92BC8890F375C04260FFB008993D0EC55FF2A0287A3F4D5F6941A
                                                                                                                                                              SHA-512:E931B8005833D693EA01252F93DF0CCD8ABAE57CA487ECB4DC22056E178AF68E204C671EC4F621BE9806C6D6C0E3D8719AA14F734ADCC15C9644BE4FC38FFF3B
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:D}1_......$..e.D..K.|.Q.v....Ab.0[...w$..]...2%..2.WW..K.Fg.b....9!4E.c-.Krg5..h...Y....N.}k.5....(..X(..%&.gA.!.u%RA..Aq.c...n...J...8.h..h.M]...}......S#.r..}.w.H.k...g4......`*Qf<....|....:..G.@.*G.d1..}sF.t.a.)?@..O...b;X.!x..p...._Z.p.\..1,.9...L),.1..?.._8.gq.....5y7..4~.t.4X...[..4.._.y3b..A.q.......6`..../....+...y+..(.r...S..H.7.(.4.x.._......&iw.z._S...".M...1?: ..S..1....o.....<.........}.h./....*?..^C.d.LLT..;T.....'.6w.W.H..@..W=.ox./%.w...%.V.......W.v.5c.k._...oG..r>S5b}R.PFxw...%4.....f..f...zhI..^;k.\...........7Oi..u..YXC.....@C.I~b..Z.p....I......Y.?C:....H....~.K.@.........{Z=.......Y...`.J.%.#6m&....4....3u["..k...<X~...n6....@.ujj....U_..\....?..@QTc3*@....Fc"./3.......<...[..C...V.L_".}..[0....u..$.p.....m.3.b.F...(<{.X....a.h.....we.#......q..9?h.%..{./.T#%.~..m..e..........y#..g,.&~.....=~......4s.l|..FdW..p.."D.3E.h..g.h....NZZ...q1o...%T...^.vC-G...+9E..F.1.&.......f......VQ...<.8..q...u@H3N..;..:...dx...V...

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\1d5599c8-3f43-42cc-8163-9a43c60a06d1.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1827
                                                                                                                                                              Entropy (8bit):7.917532550175728
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:dp2eqzL9HYmRXuG4A/qJeeftQgvtSQbRB9Ph/6fr4+:721Om9WAieefmg8YDe0+
                                                                                                                                                              MD5:8116EF82AEDC6EAC2DA7734394CF3DBF
                                                                                                                                                              SHA1:F3FF9FB65B5B4469447B0B06AC615073B689E619
                                                                                                                                                              SHA-256:1ABBE7F77AE63B34FA56519DADE623D625F6B399685CB14179BF62CB65CD622B
                                                                                                                                                              SHA-512:02F46D24A9157889F5E2388FA0E8A72D6F9CC7E45AF85F890316972ADEB988474946E9230CB4F0457718D38D9B1A02F7ABC59320C5B37A3F05544EB6805C5B91
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:8.W.H...b. .\......./.....Ghy....)T...6..Ui.we.M8u..T.Ras..!..+.#..\......7..."..Q..)GA.."6....=.-...I.W..G<.....r.E.%.<.K.a.~4!.Z..t.o.....j...m..[......b.G@...N..To.%........$.8.[.O............5c..-g...;.4g...e....d........x.v0^.O..K4...M.w. .0..uX6y.{...#p.......>-..Ja...B..m_..$8.x...t"..fI..F............o(wo...t;+.....O.-.Z.c9.{...".F.....S.<...w..K.y..!...u......-...[.K...;.]...C....{....4T.t...C.L.,.."/q...P...t._nff.C...pi.....%....J..5.x....PT,.A..j.Y.O.`.M>..xI.T.Y._...d.].g.X..7.2..`MU.....f..-wv.e..:....Z..O..........K.n.0....._5.i..k....!.D......:a.g..)...jx...1...$.....4.}..M.hv.lO);j_.... .....|&....ij.*.A....L=.*.X.i..Gn.&SF.D'.'..3..a+./.^i.f[@.EmhDX...{...Z.6...P..G...{D.|.Y.........e.ZJQ.,...rENQ6,~B.7........@.rZ..4....eY.9.7.c..N.3.8..j..f_.SF.W.&.A]>.,9.3x#. .JT....?hXLz....?.)...........z2..K.}.E.k...x...=A{..N*l.7........W.g.h.o...;Un.C..x....c...E..[.....G3.T.....N.X93\:...D6%.r.....@. rLN.nB4.....O.YS

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\277ffbb3-8e94-4f3f-acac-7a401d130160.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3833
                                                                                                                                                              Entropy (8bit):7.947542401573799
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:4j2taUHYenKC8VyTsm0SjCLZeIr+4k2ykZLZRDPS+:48FHu0TsjSjkZe94qk9Z1q+
                                                                                                                                                              MD5:263A4D5544D1E5BFE1433FD1ED26DED1
                                                                                                                                                              SHA1:8657365FB0F4C6E54A624A06B410D07E9DCD27B0
                                                                                                                                                              SHA-256:7830B780E399E83F0F6D517C5EA633727B5985CF17B674F30E2AA215CC17CA3D
                                                                                                                                                              SHA-512:8819937B08004A29ED53D813CD0247ADA8728461182717682B3D548BA0659822885762514E4DFE2C4B62A7C9D968459FF6E6B37F0DB56031DE141BFBA6C24476
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:l...h......US..gfb.]..te"4s9....Iy..N.S....U.?...Y../.V.t..c...Ta..!......U...{....o(.....l........;_~n.....',%...a..~,..MB. 6.Cf.$..:..V....t....'M6e..g...~l5...9..yW..n...g.<i..........s..&B.{.F.GD.D.;...o.u.%.l.z.M..(.1.q...?./QAI.rj.|.V..}....v.._^u".....T.E.;..$`M\...#t...Z....._.[.O;Io.E.w%".f.{l..8...DxX............p#...l.`HQ..w..........m....G`..;....%>XL.@.!..-.M....p....&.......PH...]!.K.jY.6.n......4."....4..2m..dT.I._z}...t.m...!-./.X.Ur.P...a0.U.y...g..........*.".v66..3..l=..e.Lh..7.i^|.->t.U_j..P...2.Ns.}...gV.R.r..B.....={...I..I.7.y.).|.xj....5WB3.^1W4....B.(....N..U.ri.v1.}X%.}<....l..X..^.....MILdS..U.*....$DyL..\F...q.IU.n.<.*M....R.%..h'`.$...:..Y...(.;..9!6.....;.%...G..Jl.wh.i..M_....n.M."...I.....,G.X.7..b....r...Z4...?^..].@e~f..f....V...,..)t=...V.Q..y.X...tV....M[.G...j.].Pk...%....j.../.\.....k..3R..+'H- .....$.j.6..|.......YR....e...BI...._.(..=t....p+.B...H.w."k....S........X.W.-..:u.[... .wa......P.

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\3a40aaf9-3f8b-43a2-85e8-88e3ffc7666f.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1209
                                                                                                                                                              Entropy (8bit):7.852686254767464
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:KQWwAo0din8hMI8o2/M64rwmeCArmHa9x1vcC5M/tEzFxtj+:KVwt0UjI8BEJai6pvX5M1EF+
                                                                                                                                                              MD5:B26C8548C70B47F1F710CA0E70A9A2B8
                                                                                                                                                              SHA1:6591B8985F86BD516912EAFD289627D288BC8626
                                                                                                                                                              SHA-256:D39F54F61F77D9F8007CC8E36CC9E72A89C6D458E15EEAF4D25BB18426AF2836
                                                                                                                                                              SHA-512:5741227E9E8CC9EB73A3D534C8F2478E8D86104F6A369457AB68F168D7A5E75682571F4D4EE616E7DADE6D1FAEEF86C8D9EB3748ACB393C10B8410392E2BE66B
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..gu..T...j.L[.[.\.4_...5.%[s........7i|.m....fJk.!....3..C..../.. &6........c4".*[\.)~.L5!N..L.:...2)..}..7.xO...E....={..8h..`........q..&.b.".o.....-~....... ..Vi>|^..f.<....L.5..CQ..$rQ.?..Y.,6ve.......fn<...."7...NE.%....!]_4$...a....2.Av..\... ..T.M...w......+.&..3,2&*.*...>l.z....k"7..X...c....N.f.....<[...Q.{.VhS...b.&K...~1....h....nw..0.s.$.}.3...................,.x8C.J/....m...T57..^.!?...:.C,;W.uNA.5.\.....u.o.%....e.v. ...~:.j..e.E.Y4dr.`.........8.kA3r!..l.8..v..]e.A........ ..4:...p6.Yx'....F.........E............W.5.Ps5.W.q.k..<M}.......J..W.......}..."...o.....>}.iQ.dS.d........x Mt{.....@.D.....M...<.j.b...r...-|.2.$#.A....T...N.t<*.1....4........Yq%..$)..G....GA.&3w.-....M.....;\_0.U.E...G)K...@.s..N......!.+"W....p.......),........0..Rc.;.6...h0t..........8X...=..z....Y.:....C.....o0D.S...ol>.0.5a....."]..]..F.....m.."..0r..K....]R._Y..../p.\.....?..._`n.y9..p..ov...&.A....bD..%.F..7.-A.x.W.M.....&lQ....5.Q../

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\78267ebf-1fb3-4b11-82e9-903e54a2a54e.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:PGP Secret Sub-key -
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1490
                                                                                                                                                              Entropy (8bit):7.880339358939134
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:iwFLIs4rR3KoNmOasq5a3FS/pNM6Bj7nt4uUWK7J3ix+:iII7N3QXh5asA6Bj7n6Sx+
                                                                                                                                                              MD5:D04299455E14611A31D97BC89DE06094
                                                                                                                                                              SHA1:9FC781AB1F144265D8BE5E34F938680AA8B0265D
                                                                                                                                                              SHA-256:62E145055C3D2AC68203B243F2ED7C8C6CAE68512329A94872D592F3E071988C
                                                                                                                                                              SHA-512:5FD05C64D4559C166BB9BF8A67DF9CD415A44CEE1B516F1AD048DABB18DD7E09651EDAA415E2F7D8CCD188416C6C5B020B8803CB85140A71B370E53FA8801721
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..}U=..=.,Z....c....+&.....I...3n...[...-......^Z.J8~x?.4....eN}.*= +S..G........VN$^X...@.).fF.W..)@....#...!.:.$...*..._I.....1....'.....+....,.....Oy..I....yNl-k..-.#h....sn.w.m..n..q /...7..+.(.px.D}U.&..F..................Jq...h..& `Y...t.......p.1m.p..Ks..Q...^rfcW_,Jn.........%...j..p...:...*.P-....[......c..v#.....a.4y....~.....Dq.....ikZ.?^Ud.....0..J..o....!...~.O_]Q0.rV.).............3H.gXx.cL[m.F..$.r..R./.<..).RIh..a.o6.{..)~..9..53w.w.....\\.....s...2..f.q...|^..7h.:F.._...l..Hpi.!.).../.F:....Cyl.......R>+..i...FP.:..2Ae...Pg.o.Ug6..$.i9....X..w.....%...`r`.Ii.Z.G.i!.R=.....l.G..{U.}?^...'...."D.l.#....\....\.n|..M..V..CPJ9....;N.....8.>/.6..2$.%..45&.s.".A.Z..Ge...e...~A......l....n.5\...a.Z!.J../c.n$N:.......?.'P..W .IV)Q)B.....g.n..n....yx..M.j.w.I.c .u. ...zZ..>..+@A%....G23s.^.7...Z/.............<\.s...2....t.rE..G......'..~v.m_3=....*...l.H}.-e... ....k....;a\C.g....~+..8..4=..cs+...........f..@.....jw....j,6`e.>...tB.h..

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\7d12ac42-15c3-4db9-abfe-259bc8d249ac.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3843
                                                                                                                                                              Entropy (8bit):7.9592514674509465
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:mP1V+UD5DKE3Pnax8v9SRXF0QHSGUKFPN9U+:mPqUDBKcaxuScKSGvFLU+
                                                                                                                                                              MD5:E33AF59BFD42AB77EEA2FD4F134170A3
                                                                                                                                                              SHA1:EF18579FD3F246C744B42B601F7B730C6F0F8056
                                                                                                                                                              SHA-256:AC3FB4A72F8B6AC33914F9C34BD42C468E84FB4F98CC702EB03E1847F966B8FD
                                                                                                                                                              SHA-512:52D4FC480491537FDBF6F2BB6CBF77BA351EE3CB7507E8F158A3B4BFBC41AA8E2CA36C4DA5C118325174A5DE515AF3DCF3CC10969AE5E82A4D0E5D55B5A1A35C
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:O.h.0.[.H.l....`...)......%.#z...<.w..PTQ..R..m.'.6@8xS.{..H...I`..b..1....'<y....:\.W..hf./...".3M,..T.....D+0FD.?...4.&r.|..P3u....w...n..'(.}!...~.h....oh.2.A&#....4.....4E....8..(7......E...$.g..4..t./x......6...u6......69O..6/..<9....L.06[........&v..3.K..H.24.....I.....8=D&..!......3.d.}........C'...s...^...~..._Tl<.b".......Zy..bE...M.\...K.N.h....n..sI....{.....c...v......M>...~..P...(..Bpv`.]h[6...w...,5......._3.. .V...p.qN'..Z..D.7(.v2b x......Ba.tg.8.h...(|C..J..Q...;#....;.....~.w'z...a;.;uSu....)...n..T.3}.l*0.A......"+`.).K...w>c...m.e.B....4.''..(..g..Gk.,S.<.7..v.......148.F.....Bs.......df..`'zBm."..fi......v<.;.6'.....b....:.....7..{..`Y..U..\'...R:..n)...M...Rc.$c.p.....7.g....u...,.._>.A."1.....^..l)'...s@.Q.;.$...-.....7....[....UJHR......_D.r....N..%..V..UN....8...b.^`1U...f"!...mu.-#..p(....A8.e.M"lo-[+[i.V.......t..*q.%..A[..01.$.S.7{.......^@E....=..le.o@@.3.....7...!......|..}.AD?.DK.XI.~.~ C.>..`

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\808127e8-e7ed-4078-b3f3-7f09061a011f.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1580
                                                                                                                                                              Entropy (8bit):7.883877319163293
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:8GGg38t3NQzS6R6Uss5dAJqA/CytlFJYKPiKB7uumRNty91v1ucpSgTSV3vwHS+:Lt3iCO6nFIqPyZnCtg1v1ucpShwy+
                                                                                                                                                              MD5:33D334A466BFAA1095A3321E5A231A42
                                                                                                                                                              SHA1:D2B578E0CCC0D180E3915EA4A5CA7CAB322EE421
                                                                                                                                                              SHA-256:7C51B72107563307DF4FBA28BAA25967BD8270C77005B7D39E72405BE41D9435
                                                                                                                                                              SHA-512:24BE7FB2302767D13562DCC4912B4D9F410F130873FD3CE61A245E2751B4D4CA2F6507153CCF9AD96F64C348E64A059D8D71F74EB13BCAA3E33F09D9FB1E3898
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:....S....\.....9.?..{(..\....z.~.].Acxx@.5....AH.c....n...*...X..~.K.Cq..P.0-GG...v}.+Z)lo.*...Z...vV...`.......F.*...m....cg.......y.;.5..C...J_....B~N.....`H.....:..{^.*.]...a7....W.7......z.%l.`.8.:S....#"^..R~6.j.2...n.....-{.*.O.k.nC.....8S. (..5.U.f.9............mb.B.).]t.:....X...X.[$...z.....X...t..<..U.:.".....a*>.R..cDA....w.,.}........5......y......]....^'......_.Ir....xe.......=.Y..k..BplP5En...;....b.=iRqq].......m...~.......c..{dy\.).(G..z.qr.....w.0.y.....J.....h...U.1G@?..H1..Ly....|.."K,~....i.~.f...:Y.z.R(.anT/...!..........!...1ljt.L=&...B.B`..........a$?+= ./.....5.!.}).N..d.K.j...V<!...\.X..w..1..s....>v=..P...............f.]G..uig.._...=..., .x..Q...<...j.."pq..T..%..... KMr.......XJb... vj.O...)......P!....L+.zw..".".N.:.......G&3l..Vf...-.."......1.j..OK.90]F1..C....A..ShNY.......l....z....b.c.4i.O.."...B..<<.3.....g.~.<.CE..F....Q.O/.oq..<.5+........I.9..}.X..e...e.I.........l..`..EX.J...*&..s{.9..

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\a5d6ec76-765c-4778-afd2-1e05a1554d8e.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1580
                                                                                                                                                              Entropy (8bit):7.886133146495361
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:lYbCG8gjluDSoqxPUiJlErQ8bZBu2iHVvgs2CLxhVIEb2LKr7g8B+fs1UTvoDrWm:SbigjhSS0bJi1IXCNnX2kGfro/NY+
                                                                                                                                                              MD5:590B5A1BB0D8081E68622F3AF45BA88D
                                                                                                                                                              SHA1:189BEEFA754FDAD488F1E1B7BFED3F99E677B9B8
                                                                                                                                                              SHA-256:30F165F6473AAFFF18ACFFDBB5CD08F4F0580593FA1A6423EDFD98E09690CEBF
                                                                                                                                                              SHA-512:6300BD13B2EF62B4512DCD4FB8BA0F1D169E2777F2E82D9743B7FD0DFD76CDAB14C771179B5C5FB59AA815D003CABEEBB6CF9F6557F01FE30EAADCB626B81696
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.w...kO...@.<..<.T;.....9.=...uAY.uJ.k....+V..2<..*"M.m..j....r...tJ.n............]....!sb.N..@.?.`..E.......G...3.T..|..x.`{C..\..|{I.5)Y.....6R..P!Nw..M.W....e..}.b.P..K..J;......r!...h.4.....Z.......7..k'.wr.}..A9..X.t...KG8A...x*4.....o.JqP.~._..z.q.......C......L.6....Z...*..G.C...#..p{S.H@.t.5-.$.1.^$m..<.E..Z.z.r..C.p....yJJd.....d?.t.U..1xE=!d`..{....Yd."rw\Y.\~Ten%.(5..C]....w..;,.m..U.....R.{...k.u#..S..8...F.|..l..gN....&6.Y.dG=..v.;7.|.6.6L.8..R.;.b......!0..x.=..zA_J."G..........st;....... .f.q.f.!.A.:...G.>m..G..g.jq....;7..!j.....-z..A..$."...`.....2.K<@Px.;...s5.8.......*...(i.X..]i.,..K.=i.....av......'..y.!.}or.<.*.6a........!.2H...i.q..B.53..1r..Xpr..;\a/..'...F...7.N...S.2....@.../..;..{..q....l..J..n.^...g...`b...&....T1....:.,..}.@....a(V.*..p...^...CP.......BhI.....>.4m.../>f.[....`...jj.....d......T.|Q.....R..../x....".HoU%..+.~"............&.._.....(g.N...A....D.]..M..qa......FA.c*..k..;....t....w.).W=(...y.[...

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\a7174184-f177-48c4-876a-8a51c2ed8fbc.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1828
                                                                                                                                                              Entropy (8bit):7.898478325644575
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:52xunhGACuyxRb2Dt1nhQlmSrtdU7xAq3p5uj9gzFQpRq0H6tMdbuK4tDEH22++:5TMjuyxpcQY7xFujuzCpR6t+yBwH22++
                                                                                                                                                              MD5:2F7364640F0B0F6B4032E9837F51871C
                                                                                                                                                              SHA1:77227B7B8929A7816716FAC6E4E6C8CE0B668436
                                                                                                                                                              SHA-256:35D17CF2AB70685A551620C7020FD08AE8D7E41E008028622181C08E5FF6E110
                                                                                                                                                              SHA-512:417398835509E708B3F6BF304A72740B37F6854B1F0318958AA32E90BE17668840C94523376A121B61515FCE5347E908A551282B5492426343CFC903F37C03E0
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.E.|.....T..L.m...E...j.R.K.k./..;+.J.....&..]A.c..3...C.P......>.c.N G..dsXW<|.T]f........X....&.>..*8..}..f..G..G....O*:.....'|...F...b..m']2.54.wG_.$i.K..=..5.....2..Tt..t.pi.6..8..B.2..(..U..S...u..$qM[.b.X.OJ........B.]...jT...&2...@.S...zqG..P.6.cId&......Z.+....v`.x...5Z..G#.Y...4K.....R.....^`._tn....."?m..(X_.....ta`../.V.HK@...8.q.s.S....B..H.....Qx*M.F.Avp......$..+.....T.|N.....{.?..L{;.Q%.,....X.~.o.4.......p..:..=...0...?O.....L..........Su.&.....r...B...:.Y49.Q.EX7..*.y>N..*J......_V.[..eY.Z6.,.)2.$.....%O.t..IW$.h6"....wd.......%./n./..O.d....,....0...[p..`...I..@z....?.I..........2S.........=0U3..8..t......#..J......q......AFK....G6c.r`..E.A..(.-..h.=f..kJ..E.(........)...I...g.n.........'.X..~....Vr.`.....\nd<..s..Y.n1g.b..t d......|hj...xs..9|..>>'n...ui.3....$....G5w...s..I....6...Y.G.K--.....7..H......3d."...D......{..G.N....9r...qb...yj....h..%s...q.].m[P.R....."...W..*E6.N.....@....r.6...o-.Q?.N....R.:sW...?_^.

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\tmp\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\session-state.json.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):407
                                                                                                                                                              Entropy (8bit):7.462254872642193
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:Dr2qDmqzGwM3Zs1zMThUUkjtbf5pkguIWXVbKf72x5Y3kVpKcgsScMMUnK9Y240J:DVyqNMJizISbx7uzlSoY3kE3O
                                                                                                                                                              MD5:7858910AAC3B95509FA3FAF555C8FEF2
                                                                                                                                                              SHA1:4FE9E080AC9E4F7872C890ADEB62847AB52D1683
                                                                                                                                                              SHA-256:BEDC74D21B55E31D98A78057460F407D3F22C1778CD2A10CF12FD185D83D7151
                                                                                                                                                              SHA-512:FAF3F7215DD7F01B8AC4CC55B7D1EBBB3AAC264838BBBEF0F682F2B1A8E628D8B6A0346E2D07D61FB71FFF93DB4623590A832212F8D93067D3AF7EC2E63437B9
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.s.....c..'<.l...J.79f<:....M...U.....a.d.F..5...T8.h(m....-.T'.-.%Lqn.....!...pV.......1.9..:.Y....q..D.4@1|...^...S.....^.kV......"..zI&/.*.......E..:...o99..... Z..e.....*.$U.........>.$.&..i..xt.J.w=M...~.F^l.K..'.C..]...2.):.{0...8..........s.A..B..O...R..<..p..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\state.json.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):288
                                                                                                                                                              Entropy (8bit):7.232243166422685
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:4z+PJmohrFvqtQHlkXSIBQceRQp82UA9SHiKcgsScMMUnK9Y240pD:++BfPvqt8+LBJO88AICc3O
                                                                                                                                                              MD5:A93DC7F483F42D2051BB8EB336AA55CB
                                                                                                                                                              SHA1:CF79FC47B92E4B6581C0B3E4CACED181D9503B57
                                                                                                                                                              SHA-256:557BCC2C7F9BB9183254B183DAC70F62641655BB8083986483BA7CF16173CC14
                                                                                                                                                              SHA-512:ADBA005BFDD146E7BCD0B8E47B8F2A5C3A25B9E0FEAE82A389A9A1A8D92BB2DE282761DA57D326258ED0722B4C29176DA86425F64EE90A6FB06C149BD8F8CD56
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.J.%SQ..u...!..W....q..c.o.PM.....hV..].p'.....99..%..,l\.a...A./y3...1t... .$.t..i.(...y{t...w..[.4........0...oM.H......).|...f.G.w...a.;..&o..g..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extension-preferences.json.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1346
                                                                                                                                                              Entropy (8bit):7.888268987863569
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:d6O7dIGkkHELy8XziG3UgW2MGVZXWeVs0wwjYqHFBxYRInUIF+:d/ynkIYnPFyGgVLjtFnOIF+
                                                                                                                                                              MD5:6E2EA493D58B0F47F63A1FAAFA270160
                                                                                                                                                              SHA1:9489C2DF6131529C0EDE45A6F4781868B5C1F637
                                                                                                                                                              SHA-256:44B2ECB65E5F5F6B1C8F9B2A44E116050A4AA6867213EEB2BF7FA151A5D5F49D
                                                                                                                                                              SHA-512:4413B658DB1D59B604D008EF67560658EB97B593BFE3DA393CA7378C481B96F9D7F11E2B4B94194F065C1C45DE67225E5F50E40D392C94615E4A79ADA70645A0
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.ot`.+........l.H.M.._........S......E3r...O...c9.....9.M.F9sT,"Nd.%.C.`6..#.Ro?3.. ...`.....7..j.....+fj@im.e.q.k...:.f..F.6./..A...Y..*'Aw...I.#...+{....E.3.p+..-....Z34.;.,..h{'.]&..%.n[...a...0......5&...zW.>c..i.D.?!u.c.SE3.!6...4tw......... t...'s.&zy.,.$.R...../+...$..G...hg&...GYRP.!~.B....0....._.6.S... .....;._..O.[XoEH.j.N{.w..{^..s=h/2....A.j.C...a....C.V.6b.L4u2q...4........x.Xx..&.....J...g.d.$...._...!...M~.9.d.mZ.xM..Q....H:..JU..y.../*.&:.@.`....'y...@~.W=..).D...f....c..."...U......N..P..5.)}..q.s.S....R...!.x.f........m:G....r`..G*K....o..``.j...X..7#.....C.kT.X.c..L....2.1.O.}i.Q........|.xk!.T....8.#..R.j..........S/.q......U....o.b5.....8....s.s^H..ku..5..%..w.GbQWw.v.K...Md^..%.,:...#..\?5dMe].....IQ...CW..<m.}.&.j.,As.......x..\~"~].....M....[.8C..C...F.S'.h..><.eK...V-b..P...........d.UJY..:3.W.`.+q3.h.2.....P]i..O.yA...m.k.u.....C\.......Jw.e*.A..-d..Mc.=..@.}..OR.Mw......J..........x...2qt.......!7^.EX6....

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions.json.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):37072
                                                                                                                                                              Entropy (8bit):7.995071078804788
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:eJkonypjNlvyJBU1+FOrKLbGNwNyd5MftaRQ9vMD6kh4Jr8PvNB:Uk0ypZl6Ju1+FL0sydmftae90n4OPFB
                                                                                                                                                              MD5:96FD421D5856FEF2BCBA35147FE08CE8
                                                                                                                                                              SHA1:EC6731FC3CCA3E4D21E00704CDE4AF14D7F27C32
                                                                                                                                                              SHA-256:7E9EEFD80D90C63A885C920723BE35B0C703526C4F9493EE95F9C7D34CB9A339
                                                                                                                                                              SHA-512:8AE4A31B2D38A11E4315870CBE922C8FE62C544FEBE1EEE7789AEA07339D2A08BE98AEB5A35C6D0F97BF088E849BEFDD67006A1FFC4C55904FB39DCA888B1F79
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..".,P..z..$fC..!.....6...s.wF.1&....P.....'C.c..0^`.r.X],.d..-ED..Th...}b5.Zi-.#...|]....G..!.0.@.M.8.W._.."~!z2..0.q..z.e.j5......OEd..7F...J.Y..U.d..p...W"6.L.'.m$..}5....m.......t$.....-....f>5..E..?.=@..u$+'...n..f....1...K.x}..?..b.*.|e.".y..P6|.F..k.&dBV......5l.{_dx.2..6.....J.c........a...w"..(....mz...Q-.y.s*D......Va.2.$S.M.....$...n..u...)..]..p.&.#v..AR3.....}M'...+E{.......;J.jh.O..^.....l...D......8;..x...........>/8o....I..0d...3.r...FU.2.;.i..m....%c.......M...!.o.zK..Se0...fG.U+e..Kq...Z..q.S..V%.....4.[.R.^..D..Vz7.s+..s..t....T~..wTa4..QqKA......Y^F.u.mU...%'_pIa/u.........{...B;.V.g3.^8)..|=.2...%.I...+...f.[ .bE..(...T.r..1C.....v.v.,.MW....@B..,4{}..G`D.s......Y.*F..(,..X..\..'.<..-.....K..#._%.1N5iA...P.R....:s$....../.H6.x.....sI.[.."........?.>A..f .R......IS..........{.u.D\."...].nQy.e.u.R...X....i..`.w.....El.......8d./.0.Sa..x.$.(.16.....4.......iP.{G.*.p.nNqT.\..@.....ta}.!.....d....^........^.&...<k....n...

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):33020
                                                                                                                                                              Entropy (8bit):7.994147381699993
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:XYwISbdzZeqx62WArXLGZxZvv35Bpsh3ZbAoe7dabSLDMwTTewk:XYwISbfxQ2WYXwv35BpopPU9XMw0
                                                                                                                                                              MD5:1024B5CC00E0EFEECA2356C7743DBA8D
                                                                                                                                                              SHA1:65BD29359A3FFCEA93E38D2A840F531FF7DFFCBA
                                                                                                                                                              SHA-256:7DD7634598A2C81D2FA44AA09227DDB757619CC921629CFAF360496E23B6BA8B
                                                                                                                                                              SHA-512:B712CD4B0087E84EE4D5FF2C7715EB385400B816B84C8C42E1BBF16EF0923E9A86E82DDF8D4092C879FBA9E23983846444E85237538D35BCC25570118956A674
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:....B....4.........a4..^.........HH.....k..Lt.......o.....~....=9..._I.[.u.~JK......s./*=_.......m.....(.....S.#..;.z...(2[`..{.W.3..G.5..U9e...J......93...[m.a.9....^..V..fqG.~..~.../..Nc..7F..Hj..I4n...Ok..5Gd'O1.}'......]t.mGj...`.T,=..f:.-......{mi.N'.*...L.TK..E?.U..}x.....X.....egD;.._L..*'K..L.....5.\....60.../.......&O......K...e-q.t.=..G.........Q.O.=u.l.7....7>;...r.8f%.[v.....16@.C.g...*X....B5...X......l..tUX.....c......O4R.......V.S..f?.......Ca..2.^a:.%`(....n8L..x..Tz.<%L0.......y.Q#k5e[..A....t....."............Ww..Ev.y.vq^.Z........8.V.....?..>..~_.%.UX|....>v..O n....o....W)k.W.....B.dxE..x..HHV.+K.3.G....Du..".(.j.....7...U6..ON....^N.:.......w.}.?q.|...;)y.<A....J....Pw.....c...xu.U..:+.&....w....Z.R..wlw-.9.X].C...T.."..:'^(mR.......:.0..;.?x.*;*....L...~*."T.y.......:..$us..Lm............w.d.(`. .m...e8...)...lb....#Qm..90..\.63D..k...&v..N.A..t7..a..]!.....z.....4.!....Cc^Dr.....1...4.w.%......L.kC..

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):5243126
                                                                                                                                                              Entropy (8bit):1.264563696080557
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:wmd98/qHGFFWNXHGkXbceMIpf0dolDFhmMxpUSX1n:P3mqmFAXlff0dofhtppp
                                                                                                                                                              MD5:F6414B58C1CF40DA592DB23D5728F43B
                                                                                                                                                              SHA1:F76E8AFFF14ACCEA3938F8DFB09F2829FFB741D5
                                                                                                                                                              SHA-256:F71B4AABA8E0793A50128A772753A24AA644AD2122D8E279B4BB0C3124FA07D8
                                                                                                                                                              SHA-512:E0EB02A038160ED47219F78D897B0723D69C1060DD10C4F5A27FC08069C2F77D2071BFCC15CCDA7F7E86DD2A1055B95C6B50EF2307346B55DE56DA2856F1D3E7
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:m.rl.+..1..(..:..._.mO....Age.m.P./c2.j...duV.2".w.@.5......!...o.J.e..?.r.......kd....:F......<...._lW....p.6J&L.0.E..........i...q...Q.UPQ......q.....F.T...{...9..).`..O9..;Ax..;...;..za...f5%....{l.q.o...T....i.c........s.o".....`......OI......\D...z\.)+.*;..\.3B.#......'. ..vw.*Y./..6..2.P:e.W.......9\..g.T.....#o...o].,;..4. pi.0>...g..."...S..g....../X...=T..C....3...y3.R.S.F..E!_WS..7..J..Gm...UU.BS.9.>g..7..9./.BN...1...>x..|._b.......;....l'a...x..+..w....X4W..B..vF.E..4.MQl`K._...p.b'.Kd............6.YR.D....8......<U....m3xeM..FL'|.(.BKQ.....X.d.....=9t..\_..%....tGV.c.H$.....`W..&d~...E...Hzm.TI..m.I.x....\_..9.xd5.^BZ^...Ng.dv.s.(..t..b.....rmy.m....X.......s.>......F.*r.#.f.}m....F.E..u.-....%.......DC...".,..E..<.. .`.V.W.l_.V....=.j..H...{..9.`...#..&.'v.v.Xq...a....f_Z&l_..Yo.....&ye.o..I<C.P.I..<.:.i..0.QY....{..,.~I=....x.....n..K..."...:.B....S..}.wa...v.. Z.;.G.....]m..)(..`r..y1Q..0{....GG....#.,.S..@........~..*.

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\handlers.json.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):622
                                                                                                                                                              Entropy (8bit):7.63781536317872
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:JdYE7M6InSElJ851BIibPstNAk30y6PFrspjEHLJ3O:7YbfnSElO5AKPIukj6xnN+
                                                                                                                                                              MD5:82BEE969432CB2A97D2B5F9C3B648717
                                                                                                                                                              SHA1:13526CA8789568A2999BD08BC547CED4E671705D
                                                                                                                                                              SHA-256:FAC501D05051AEBC4DBC5AB23D69A9DE6D31E3E11C4544056745A3A55C4649F5
                                                                                                                                                              SHA-512:AE2C31D18C6679FA146E1621F2C88D81CDD24249D5D316E00B7265544A275B2B2D01D864A37BEB480F61F030E50F6B77C477BDE4C63A06DDB5F4C551A2E7BDD0
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..;.|G$o.......SB.J.:7Gm.-bL.B.......c....,..e.i..J<..j4V.9.^.-F3{M.0...5."....x..Ik.....9_^.<s4...5:...R......a...o.....n5.!.H.)!65...K.R)....?{...............].q....a.%.1\0.1].y.V...H\.(....M..H...5?m...k..}~..,|...oGa#..U2..i.H^^..E...@..y..j.. ..`.t....^SN.S.n.1...!dz.xE...@./.$)...+_.~..zsD.dU.b..9V.jC.......Y....;...cc...r.P.7.a[G...nu..dH...f:@A."9..*........`....tI4..cn...r.$.t..i..xt.w.6j.'>.Q...G.>.xAR}.V@..5.U.$.0........$......m..U.%C-.}..:.l..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):295145
                                                                                                                                                              Entropy (8bit):7.99935317412491
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:6144:UPtRaecWpBYN7sPla8qbkFLx0vsXwkb35LNpMxfDoyK9m6f:UPtRFFBYN58qOx4iwC33pMBon9t
                                                                                                                                                              MD5:2C5FD72A78ABE7F1EA4475A8E4B176AC
                                                                                                                                                              SHA1:5C75C20E0850C7700994B0D037C7FEA06A56AC91
                                                                                                                                                              SHA-256:CF1C88E928537AD481773AAEC48AA3834E29BDC85AC7D2BCAEEE8E2AE8287E24
                                                                                                                                                              SHA-512:E813404353D9A92010C88730C7CEDC336046940E681AB94CBE03EC8CBFBB4C5B9E8EA8DE0E360E5D399E9DEDFBA23550C972C633FD82C22E405DDB721A19A122
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.+.N.L.m.A.....0.+.:&.1.w....a..#i..I.7+..&..o3`E.X.fu.1...m.k!.o[.........,...Q=.)...u.....r-#...v<\l.9...x.d}..}.,8R.vb.................Ej.r..`......F....-..tp.*.sZa.9.6{..Q.q][Q..nZ.Z(............/a....{K........n]..3..*. V.Fa#.LM.J...;%...9w....P.:......!1.aZ.........n$!...oG.i.w.[......'.!..~...9..2..=...`.N..}~@T..k..Y...CW..).a.........^c..&b.f.*C..+..A........P.o.2.@g..eUa....3.X.~.m.0......wl....^(...~..X....KwZF...O....P}...[...12.....3>.$+J...~....z..&T.......j.t..:.q.....,. .i0.>-g`^@O..k.o.z..d...RuDz.....).2K.=...z"=..P.....;,$<k>B.SV..E#.u.....eqT7........:.g'n.U....k=....Z..b.y...QTc.7&e.}.A...?.....I.._.o.p..T..fND..].....x3....(.&Y..nX.a....V..).G.)=..}A...a-..p...A.....I...<.}A;..1?.}.>....d...L....2.p....$es.s..r.....HG..w[z6..c........B..-.w.........*..I.x...........W.G`>.I.4...UL.=<.s...-Oj..O)k*.g1c... ...jV.J.......zv|...z...7....*U.L.6..Jm. 0...&.G.\g..O.4Zk....xH..}.^L..f:..nL:..*..d....."|=...mA^....q[......

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\minidumps\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):98551
                                                                                                                                                              Entropy (8bit):7.9982488503316755
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:1536:1XkRQSEyQL6pt5vVyXrNhKV0UnJiSH6ILcy5nEZcUDqo+ycWTV4qlS:1Xx1mTyXHKaYN9LcyGeDCVDlS
                                                                                                                                                              MD5:09B1AFF6E6F264C4FE635F06C909FADE
                                                                                                                                                              SHA1:D672DDAC6C6F333FB31DF3E554DF760DAC2B52A9
                                                                                                                                                              SHA-256:7D74922DFD9F18BCF27F3953003E5F5F156C28404369B4518181D328151E2A4A
                                                                                                                                                              SHA-512:2EA65109EEA05FE0EAAC316CEA3B2A87DAC25D815601340D492E90F4CC1066151462E1292BC4E4570FED34BB88571E2B803E702C433B0518C73DDEB340310D2B
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..S.x9......<&.)...I.X...............G...g....y&.....$.U..M.*!.....#Z......!.B.;.R....3.8...Y..lk...|..o....+..nb.X..l..c*.Z$]V...R0..n...g.lv.\......?A|..6....'.e..q. ..}..^.<.j.._..........;.T...A..n<.S....gURb.4;.|..J.......A.E.F<..m.5..C..HX..'..d.........x.;..../.d.9....`,...Y.ZK..ZN...d...fr...pC..g.Gf.^P&..b.x. ..`...H...J..2L.kc....z..h.-.e.~.."4{i.2.K.|,..D......$7....;.. ......o.:.:MG..6b..Dr..../.&....#>..G...x.Xi.5.a_D.....!..d..~......X..~...K......o.Q.......x.R..k..zCI.B...hPq.rL.5.[#p.d$ZA..~....YGmyn.n2..........b...)..D.'...t.F......M..n...5...U..e;.1.D.9Q..(w......xA./.....^Y.....?m.v.x....q.+.R(w?........EV..{....p..u...`...j...E*(..1:..6K.').._`\..hVD...k.....z7.[z' cR....f.qY.d4:. .A.5D.0sf...X..b..3...5.'..>].UGT>...z^.......b:.R|.......tZ..vP...\.%O....m_.a..D........R7.....,..B..9.>..._Y.).Qq...!>..\.?.w<..nS..\.....U.1}*..t..G=.G..O.hVNP~.y.e.5.yMP.g.H..f....a=M....~K..f.........B....v...... .... .S.%[g.<as\)...3.

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\pkcs11.txt.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):753
                                                                                                                                                              Entropy (8bit):7.762755676772276
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:4lq8XzYgqmHJnSyKDrwI0bMav/acZDBxx5EH8JdxJzhpsOJuJ3O:4lq6zgmFSyKDt0oavhdxQH8JdxFhpsAR
                                                                                                                                                              MD5:B1157273AC760CF101E9FDF3ECD67403
                                                                                                                                                              SHA1:E569C679045C236A3EC8851DAF6F685C24C01968
                                                                                                                                                              SHA-256:B069E2E308752F65EAB0E4FB0F48D204035132691D55F2203E0B268899C3FE78
                                                                                                                                                              SHA-512:BA6FDF2422DB811FBCCF041BDE9F9E7BA8DA3B5BB024424A5CF76725E5F0744C9AC8C8B462D4FD1917DBC953BB803D514C1AF483CBA4581947D0BC8D1F6FB6DC
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:G.x.t6..........r.`.).,.g*..=.34...1./.._..*.a>.e=.QS.&.R.X.mF.t..%.@ .B.....;.d.....p.5...[..!v..?.K....4...Y1.4.......+.:.q......a..C%.f...{...p7...10.....d.....{S........tS.....Z9....[..t+y..C1.-......+:..oZ@.."............_..j*....#...=....i(..6.~!Zx.....Yv..*SGe..A..+...B...]l...]....H.D....P......vB.A..f...3.6....`U..yKE."....p#?....[.%CS}...a...RbC.S1E.j...8..zaQbh.Tn....{.-.t/5n..)cR^.u..}.?.E......AD&.`..t .UL......mL.8.p....xn...B.-......w&...c.Td}?.q.......t.8...... ....".x:9..'..S..%......-m&..Gct...#.$.w.......6.....1..O;.M.l.P.....4)....rr.c.P/..&..w{..po....I...f..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):33014
                                                                                                                                                              Entropy (8bit):7.9940269604138585
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:qEBjzJV9BZu5cBTCbj2zP/G2nV4c16fvbELHJQqL/:VBBc8Cj2zXGUS5HbELd
                                                                                                                                                              MD5:F72AB3AA3E973FE2B5DB0FC8481BFA98
                                                                                                                                                              SHA1:FE11487CE919733C9BDD88222E741C6073F1E52B
                                                                                                                                                              SHA-256:F310A9F1CD90E1DF0DD82B5AE8B878D244E9BEF42E04A3AA345CA84A62E0069F
                                                                                                                                                              SHA-512:C22BE6E3057D56B98CEDE368B9E7A4E46E28A414B942600A432848EACB03A0DCCB8E0A2A70681737E6705BD588F0202E0FD4FBA0555F2E9AD9CAE9CA6191A65B
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.B.}q.4.....n.Xd|....y........0.4ySd...=.7.#....&..bu....."s..A.....H...d..eJ...0.....n.{!i.}2.....2..... ....&.."...Nv.L.w.0,.M.Iw..%(...P+...rn.X...6;k.F...)).`i...^...V .3............+...c.,.xb...<.....4b.|m*S4..@.X_7..rrW..Ss...J..UjC.?..lN...#.....C.`..w.-......&.u.|\.w....c..H'%....jG(h!bHN.Gs ...l.k...l.......M....?G..;.~,.w.....ev]....R...V_..h..h....,...4...h.^.TR.0Q|.~).E..z)...p.c}U|.9M....>v....P..e=.Kw.x.=:i'W....U....@...U+..$...C...qb*8J1./~3N...NQ.I....8h......v....z.'..aNS..Tn*.yR@.......D..Kc "...B;"........u......F..n Oq\..$X.<]u...R..6.^.,.N.&..!.v...-..0.K.....t.fI......y.F9......@<#...PEeFTC\xL$o...@....,!2..k...._.e...[.!......TE....X.{.."[...f...N.....ug.,....*..!...;#Op...O..k..&.R.....d(]N....._...F...Gw....+m....H.W!..6...bH..n......;&..5.....}.....]=.c....6.~FN.P.p..!=Ff.p.&[\6..~......../.)d*...C.*N..]...J...C.B.e<j.D.>..3m.....+t..2T@j.".F..s.|.qX.(..M..,>.(...f|p..>.U..s...T...L.of.]^...)...iA....8<...X..!Y.c.

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):5243120
                                                                                                                                                              Entropy (8bit):1.2696534105140405
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:DFKZIJwXmCo192RTCghn/l3y8geTICm9JtXO3PauJpbFU6t:RRwivkTCk/lPgr9JtXO5JpbFJt
                                                                                                                                                              MD5:3C69AF206466066BA32798CF82A21C20
                                                                                                                                                              SHA1:1B5214046C945FF837A9CCA674DE0AE7A198A8F2
                                                                                                                                                              SHA-256:A4C40005B2AD36DDF2B66064AA22723F39221B900B80D9B4A4BA8716DF943694
                                                                                                                                                              SHA-512:BEC87E8EBD34D4DB277E97089BC234BE2ED3204850864E762763C81E6B4B69AD480D19C3BE1684996AC1473CF03C4167751040CBFBE9A84FBDEE7CA9349458E7
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.......Y..L/..]T._7.J@lo......h|d.....!...1x..-.....~..`9W........[N.`&Y..uw!.Q....1..m....=....H.Kn...{.Y.....w.h....,1.[.5k.}#....&o....8m...\e6~.1.w.}m..uwU..B...5....@/[...8........|zau...`....:..].w....I..KH.M,..L...M.....c.P(...a..>^...D.H.A,...ksT....+B..L].....%<7..M....0.B....L..v..6 .........d....5.6..AQ".XF?.y..=&6..W.f..~..jq|...2}O.^FT..U..#.1..)+......z.X..b....._,.._p2..(. k].[.2.:f..E.....B.a......F....t.~.dk.p....ep....Q.`.A:2z.vr&]..GuM../.=.r...'.7...!|..+..J.......;...sCH-M=..'#P6.L.."...c...^..K5b...Zy..$j.....KT...n.V.2....=......Q...}DM.Y.!.V..q....R..F..).@...C.....J~w=...*.|..y.C....|...k.`.Q...\.mD..]..j...V..A$u.....'..U..P....2X..2...U...`..=....i..... ..((@f.b4..x.cX_c!..z..h...*.5O.=...w.z ......hI.VW_tQ..w.J.&D..C5..A..a.l..ix9\@D..9.Z)....3r...b..U.;....-^...:..\!T?p.m;.F.4f4.Vzz^j.,......Y5,@.&.q..31..K..u.^#P.......Gh...?...].#/;..3G.....|$.U..+a.,.%...83.C.D..68..M......(...$_..".x.P..M..fNf..D:..j..y!..>

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):9805
                                                                                                                                                              Entropy (8bit):7.981281628398157
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:9T41+2t6Mf21jUls9fMv9fokt6qiP4V6i9aigSHinG25FrpE8+:9TSJt6M+1os9/kt6jP4s8YTK8+
                                                                                                                                                              MD5:827F326371AAB962853D9B06F017DDF8
                                                                                                                                                              SHA1:491DC0C49C7708B4610990574807F389768A8161
                                                                                                                                                              SHA-256:E57A572C471C9E0BCDC579545ABA42F675D747BF727B09858CE0FD58EC432B50
                                                                                                                                                              SHA-512:E3FFFC2E2C99C114AAF24FE6DF64F980C9FFBB50E0F3FC53C714FAFDB46A4EC18D72D2F68D329F3371A29076EB9D615E440B4CAD778D023A32F93B6FC9C0C4B7
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.W.9.-cr..8.....4....t...U.K.b......R.......j.|.C).Zh.R.K#.q.Kr8...."N0I.z.;4..cM.....(v=g.....q....j.$n...e.(...0e.J.S...j#9.......W..!..+...c.:U.*V.l...sw.1....z.h....Fg.&..?C..r.Q.+.....M...\..=..L..B.yBU..vU9'.y.q.>......j'"@.i.U.tD.`.Z..r.u..y...JN&.H....`{..-......v......Q....)4...dw.......}..._..[9(.ih~{.z.}p.+.H..\.2....-.h$6G..6.C.f....E..=9t......,......q...wY..O2fxn....1J.~....:.C._.....TL...x.7I......h....3YR.`_J..'.o.=....z..&..vl....dbo......9..4.J.12.x....d....Cm.#.g...i._3Q.d...K4?.P8anJ. 3._.Y.fCg...,.8.......g..1....!.....-...<T....*^..R....8o..,.......g..\.(.....0..tCLP;P..\{Z.P.....I..!Zk..{g..D.m..4Y..(9.bq.\cS..1.......S.-2.3\..j.6+.V.z.-c.EzwW.5.\..........J...v.....Y....1%......$}.2n.dkM....0..H.1-.!L.sF-L.y...5.8....i...4..~i..<7r....Q.`......#]q!....6.!....zVc.*.S.^.....y...E..H.?.a.A....j.!.0.PM_...9+=...p....e....(./{./K..V.Is...F...@.*....y..5...C..4'H..6D...G.+....g..-6mv..o......v.6.y..u.....,.....MI]\./....X ~s......

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):65783
                                                                                                                                                              Entropy (8bit):7.997117289602361
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:1536:/RUvFVo6uY74DHrtXQFJ5z4cqV9r3+4FDaOLcB31MvykXOu1wjBIuk2Ju:/6vs/ftXQFJ5zNqV9LbFD7Lcl1MvySOo
                                                                                                                                                              MD5:E2ACC2884A2410AC97A2FB7C2E881D64
                                                                                                                                                              SHA1:E50CE8028D1BEB610FC9D939A5DCF09D65B2E0EA
                                                                                                                                                              SHA-256:BB71958622057E2889E10494632513B7F0561AECFA9951DF665777B17CC5EA40
                                                                                                                                                              SHA-512:41E7979BF62C63A2170E59A63499B6B3B0E479AA58E12A1DF4A364C549AC138B50482CD5B18BF3C60DF2B4A487C7E9B2D936850E16546E41F60C095F2E10E9F7
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:...z......|.I..A.3&...9.|.|..y...-..$.....d...].k.:%R.....1.8...<?..u.~..z...x...5,x....l.;.T..).{ ...4V.}.]Y.'.3mZ..\;$..fX..... $.a.......y.W.vh.....\`../....\T.U....'..j..#.Efa.4M.H...*e..a.#.]z`.X...p.7..."c-.....sB..P'..75a~..>D.P..M......`..%vUO..<..4.l0..{.K3...p.......dv.]X........T.0;G;.5.0.'...J<...I..i.J.q4.d.MR......A;.B..|....B.$..-.....U..9.h...D6.._@.a.^...5. .@..k}.ox..ix.K.!.}o....;.D><...;7...:~..nK.0.....O.Be.F..tP...1.z.[....Uj...f...r.t...6.r.]...d..N.z...j......x.s..&0..6.y..u....`.7N....{!B......T..(j.n.....o..U%..X...:..>......ga.y............o.j.y..M..8....../.....g.FBCt.O.|.w..t./&.&..k.i..?.|......C.}.W!<.n...+.e..g ... ......k.....:.I..Olh......b4.q,gA......*..y...H@3i....\DA...."..FKv.;}$.I..........:8....(..2.,.<...(<.t=..y.v..:..0PI.%..?O..?...Ep.A*.f.)...?..H......'...qPw.?{u..{?v.. .!..{....}.....O...z....Ii.3 .R1/;,....YK.i..\.x..2.2F.ho.k.....d~..*M.6'.........G.>...x.U.....?;@*.95..C!*./..Z....fT.

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\45e26519-596d-41a5-b290-e547b44111fd.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):758
                                                                                                                                                              Entropy (8bit):7.719038747438136
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:98x5nVrTEpwO8ezRohdEq9umH8iK+62Bf4k3OFqYYxDjsXP1noay2rq054Gvw42X:98PVkwcRoD7RHX6EWFqj8P1dy2rq054N
                                                                                                                                                              MD5:F5ED1C657B73062E10E52228DB5AC29B
                                                                                                                                                              SHA1:A5E0323958B41BCEB3A3D83EEFE669CEC074A83B
                                                                                                                                                              SHA-256:E41F28E0C65842031CEF8C45A49F38883D5177C38F4E624F4343CB092456335D
                                                                                                                                                              SHA-512:1ED2A794A77A4864E761D350515278545FB7829D2E090332A1A0FA8B9AA3BD56CB5E19628205CCD5EDA0B994ACD4459BF037E2B5BC2B8B32DB5BBF0896A061C3
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:... ..........F\~.....v...%q..U...E.1%T....;k.<..4..L.zL..=........j..gaqj.b....5../.$-x>....p+(...7..5k.}.U./......C...+..&.0.;.....[.....!..^c.Y....Q..C./*.gE?0...$...$u..4...?h..TjC........g...."..,a....+@.E...T6."*.$.V.QL..R..v....k.e.......Lo9..J\(..Q.....`.R..<`..F.A.v..u.k..I{_.z!X.........*.'.......sS./.7..v%......)...e..B..j..m.`...f.M.A..,..a....`h...QN.....E........F..t(.....c..z.(...v.tw.-..Ka..m.x....+......Q=z...b<S...p...|.9..&.W.t....{r...r..mtg~9..!..T..:...0-.Il@).tB...R.....l..^...T.Kv*.....5..../...'>..mwM..5....)FS[I....;V.D.M..........rBetY.t..>._.m.a..i.'....(.2....X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\6fc53411-ad83-4cf6-a5f6-905f0f3f52e8.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):760
                                                                                                                                                              Entropy (8bit):7.740931729687642
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:wtdK6ayNrj2Pzr90pcecyll1Ujq9dBERvQbB9/I8oiavLNglMpWiQQm4cXiJ3O:cd7ay2PupIkoq9bERvQNNB3avpgwWqcX
                                                                                                                                                              MD5:322AEB2BDBDDD21A50C5A1EA080E5684
                                                                                                                                                              SHA1:224F26D6F1053D57E7DBB78A2D9E680107C7573F
                                                                                                                                                              SHA-256:6AF736B39D60C9A3EB4DDD33072558C5F88BBF7BF55F775333B717500AF4C750
                                                                                                                                                              SHA-512:47E87005D971CAD64B7CEA9B7F2FAD4A317BF0EF9CB307C8C720671CC009CD474BD47E4CD4781A197947E9C95E747A5BFB677742377CEEB0C0BD479F3FF1A999
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:uo.A..AV.Z....y..ne..7kVm91.n.....!DN...@oE....r...Or.....>z.f.}K_N...v....A]Q...&i..........`X?.Q$`3...L...`.h........K..v.R..Y...<^...\.;D.r.n.Ov....W.n..K.*t\...E&bK...Wd#..e..@.y>6...I...w..A,.[..oK..E..2@.....@.,E...G.~.3....3..0..V......R........yd.2^..9l..]T"..E.m..........1..J.A.O...."..Hu..\.)...J.....1 .&ENc L..j}.V.sT..|...."..|..J..k&..S.eXNm.N.R.H...NO...|<g.f..!...M...q8.S......)E....{ ]......cc..s..q.....K.1....../3Tv...QS...J'.H...4....=...4....|9..'..Q....)..*.It.<L'F....4...M].je'.Kb.9".X`.}...Q../...'=..mtM......!..M.....Q#&A.Iy.k......q?./p..Y..{..(.x..9....z.A8.E.'.)....X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\7278f154-e8f4-4235-84c5-c5c1c6af0084.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):74436
                                                                                                                                                              Entropy (8bit):7.9975949755191476
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:1536:rVU7kKc2MbrBMefWRo1DSs40mPFIeAD/cw5kbctO6B:O75xEBXfIkDv2FIeAIiK6B
                                                                                                                                                              MD5:48A1091392E74A853E42CC7F8B6433CE
                                                                                                                                                              SHA1:8EF1284642BAADCA585A0C88DEC62F34649F9B81
                                                                                                                                                              SHA-256:B31203ECF79551DF38C8BDA044A84A3C350223816E5D02C0E0260099FD55116C
                                                                                                                                                              SHA-512:3660F66798966013152C11B344637E53903802A971A37C6C6B1667F7B3CAD1093CA932A8B23121985688FC6337C288D9EA908F0884F574532929C9F198EE6680
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..8.;.s....u.*`..y..'.`...=2x...'.a.%^N.`I.J<1t...B'.....%7.U.i..)R..Z..R.m.C[.c.:..0_.{<7.D.K.(]?.6..R8..B..|..M...5.+G.....!I5."4+.T......0..q....]...[.\wOqc`I.....R.P..-Z....;....].........=Ru.u)...p.$|....8>.w*....2....PM#.pHay...........v.p.[...<..\v.!.8..X.X2...|.,....5..&..d..........I.......|.ss.M.O..#5.,LN.*.$......z.[..7...0..o.W......\~.UX\...TeN."zSL..Q.UDE......|...YlB.......!..W.......i...q..%@.|.g.T..//..l.-(....9]...N....D.Gz.p...i....M.&.._.=..<....8....fP......`:...&..:....8O.5.H..tR31....:z...+.......U......ON.)3.........7..X..,k......./......V`m.........@..]...)..].o....`)>2].h.F&).K.DL.v.H6..#6-.A.X..8.....t....].%..........Q5..h.../9~.....gB-.\.#...#^ /y..F.2.S.IP.j...n...f..i/..ygs..y....3.p..mH..:.D7jA.lRB..?..........Ny...;.B..@...R..g%_F.+...\;...9!.gq./...=<.G.....kU.....J..YF.....:..j.5U...r.>...9k..,.....(.>..r))..>.....<.Q)?.........8e..w.#.A<P..P.8.>#....=5<..H.....O<...m...*uy<.*#...U...../.0"...O..4B.`.

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\search.json.mozlz4.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):599
                                                                                                                                                              Entropy (8bit):7.671635158624862
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:G+Q6PzVODAKSmzpzJ55HcMGMmfHRTcpMFcf0ynru3O:llVOUKSmzpzJ5BTiRQqlynru+
                                                                                                                                                              MD5:2F67DB24629286D31F180E458B66B899
                                                                                                                                                              SHA1:25EE604F2B542C1D4BF620C1784608E4CE72D7AE
                                                                                                                                                              SHA-256:90297A98A553DE3AC25E7A1CA8CB42BC461DBA71F28A907ACF30FACB7E63E0C4
                                                                                                                                                              SHA-512:D9BF3D75FBA7198D59D28F835322C8472865B36DDF5FB409E291E35CD6D54FD24BD3F113DD90F8A0D98B963E2F3EDEECAD639A98EDB7E9F2FEBEDA00010DD092
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:p.fD,*.^...v6Z..B_W*<5.w*..C.D...k..d&..\i.U........_.".Y..g.x........ .......Pg.?..9Y.y.~_.c]..r.^...`#I.~%?>o._y!x.e...i..).`.7T.....'....(.z.6.<....l..d..B........"...X&....]{Q.^..d.~..%....P.^...r...#.x%.9.4.....W.7@].,.S.?..D-..] B.P..`Bz..Q.......^...$O.....&.+..`_0....MRA...iy.[.|i.t...~.(.EH..W.>.d..O..+..-e...s....).U......s99..%.........a.k.4.3p;..m.#..&.V..;..xt.J.w=......Dh..q.`..;6...J.....`..." ........".*.g.~........@..w>..F"9Rt..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\security_state\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):541
                                                                                                                                                              Entropy (8bit):7.617438378267805
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:tI+NSZLvlrFSgYWMSbTTQXSMT2Tlb6zkSQzj3O:tpSFNJSq7iSzn+
                                                                                                                                                              MD5:A52ED7DB173289018ECBB27EAF727633
                                                                                                                                                              SHA1:9FB3B8CB14B94E209FC352F06BDF81E60B47AEC0
                                                                                                                                                              SHA-256:C8E80644F8B1188FE6D9AF0208EA270131764A33A81524D1FD11A2F151BC8626
                                                                                                                                                              SHA-512:830CD34EBA227B84AC04CF2B02832413E158B03F979D48F25CA12C00A04C90DAFFD234F618E7F683F22CE1BBA50A31FA99BE410C5CB9AB54D477DEC70667D576
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:u..Y..[...m...M.OhE.........g$.I.K%............yv|4.1..E./.M*..z...Ce..4.#\l....g..8.C.+xP.{...v.S..\....~.....Q...m....I.e..k..<......=..JP.EKr......F.\+&.X....\.9.v.F.0)o.....',.W...Ng...@.....E..>8...u"8..H..6...S.I...<W.....[...\}#.9..._..D....cY...".gu.-..yq..i...'.99..... Z..e...(lF.V;.0.....J......i..*t.I.w>....5.Q....f]I.C.........*_..P...5B2."z.}....o.^.....*i....E.".O}.w..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\previous.jsonlz4.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1465
                                                                                                                                                              Entropy (8bit):7.857839228468894
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:/INpSBcIVU/kwcZ+QWouHaslNI0S0ddGl6lDrlZ1/31VpQZOU8Mfjim3lUun+RM4:/apS0UZpJuHa8m0zGoDrZ/31QIUrbp1q
                                                                                                                                                              MD5:22C14D964CFE804CEF4C216736FEE688
                                                                                                                                                              SHA1:EF9D8298B2474ECFB05BE62EAA2AF88EFD100D94
                                                                                                                                                              SHA-256:18097DB65539E13E475DB8EB064AF86B71F4A73EE5C01E0B993DCFB8719F4A88
                                                                                                                                                              SHA-512:021F6C3C64695537D28BB4D7A73ED97469C4482BB142EE2EC0DF459873B0192ABFA7CD817E0FCA226A69575061A683B0A148862B6A08B578835FD4282E48A515
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:1.:....>/.p&D#z_.-..h2g'.._...9..>4V.7@..|*I.;....1....p..`C...%.:...W...(.6....*[.-.RB<0..\...T5...........t.Ba*..N.......&.......1L..<Fp.....vj.+.z......hl. ..l:..&.g...CW#.Z..T...0..3..:1cfe.F..M\...fD.X..nU..$....J.\5..k[6p.5.L#._.....W35=...Ru./..A};1bS;..p.........@j.@......hf..g...m.L......t8e(.k!m#...*0..F.7.0..2..N..t..\..Z.@GjS...2..w.K...M3...l..{;m^..Fehb....f..M......;rJ.o.%z...4.9.n\...u.._H.....F.X.o..L.L.*.C...C....G^..0<....fOK.Z;5.d.....-..D.fBWA.\p....#......g..6.....%.....8...HpP..a..W.ge...y..0..t[../@.*.d.y^N.M.r....;.....gG.o...h..X.K.{.......^g\...'N.A2v:.t.B{.9.9~..m..Q.,S..d..2s.R..s(.(6....Yz.Gm.......g."......".r...I..Q.%...ZED.9w....*A_..$.....,.op.........-..6...&.l...9O-....~hzt...0.A.Mo.8.._.~ @.l..s9........~@.@.*...0&.{I^..5..$..z.Z.....Zk@..@Q........N....V..&../n.^Zh/.E.........a;...H.....>...3.r.R......3...+q.5.'=....B.m...b... t8.'RE.'.j.3.3...k?=..1../2S&E.T0.uFj.1.$...b=..q.ut.M_....

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4684
                                                                                                                                                              Entropy (8bit):7.95272036469387
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:QqnXFcXtDFjncQohUlzOcEdz6pZVYyRk+XD0dEvi++S48Strw8+:Qqn1c7LoYzORdz6XVYBiIqKYstN+
                                                                                                                                                              MD5:E031A0F57D95FFD5F2A4F0FE4ECEB008
                                                                                                                                                              SHA1:A88DBD6F757CC9E452346EE920C57DA7E1FCCDD5
                                                                                                                                                              SHA-256:8D3B551FBACEDB827A964A7814B8447CEF7921DA3D981CC0B20C4F58CCDF3631
                                                                                                                                                              SHA-512:B2EE6E52369CA04FC9C84BAE6D30A4A95A2C233045751989D468C3C487D1DCF4FA130240436A3E8A827DCD08D0E1FEFBC2B8CC2534F5828D6FEAA0F7F65B3BD7
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:...b!.p...K_......t.......... ......%.y}..5..=%..MA.\Q...e.T..)..i#...zX..k.<...z.....L.=.M.........!..+....rq3[,e..Y,C.7..]....Wx.0.....r..E....I..r.ye.+....|..iEJ.\8.......h.. .1C.....y.Pd.D)....]Y-Q(...s.wK.F>...$.3qo.-.i.Fry9..>..eu...,.wu.J`...o..x.T...F..u?.(dI...S..zu...a6z3f.u.d.!/U/.....(p...]..Y... J.J.1..ow..@s.*.f.....w.~.og.1.p......I.B.....k.-.@.#..O?U.._.x...(..i.S..-..."..1.-...'....>01...{.."_.....K.[.8K....6..+?.1....x!...E.l..M.....5....._.w..<.\...e...K..gg..> ....Yj}.P.B-&G..Q.7.4...P..$......qN..7.|.1l.mez3...C0..F...wRk...x.;(.....f...}E..M..<....i...b.Id7..P7.7.....x~.(.<^..|..8%1.?F...Q....|....).j...3..=^a.[.._.:.(.Q.r......Q......Oy`t.)O.@....T.5..h=...i.......R4.&..V..k.."Z"]x....&^^)..o.....>.r...y8.......x.pU..H..W."............_g.S...e..;.[pf.:..0..V......RS.o.R.<<.kMCL..zr..{..t.O..<u.#.ZPCv].O..f<..NC....qT..B0..X...g..1...5.....m.i.O...$....+.-.5.'...?........o.|...-t....+B.(....C.kF.(...`.t.S.X..|h..j(

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore.jsonlz4.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1466
                                                                                                                                                              Entropy (8bit):7.884360000362492
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:nKG3UDxuO3p54DxeGgdbu7ImbWI56CSKHn3yuc1zeUF/f9gfrAtR9U5nLarj+:nHUqLgdbuUkL56RKCuc1zeU4m9QLaP+
                                                                                                                                                              MD5:969D42A044188EDB13D8BD89563165C1
                                                                                                                                                              SHA1:8E759A6BBC6AAC55ED92D497E188D00FEEC11561
                                                                                                                                                              SHA-256:87DDB3ECE83A75E98D76061D664A402298E2AADEFF5B937792637AC42BB0DA04
                                                                                                                                                              SHA-512:5077C6D7C4534D86495F30FD9B01019BF5D1B5FE07EC7783E91DF775D717D3E69687EE0CB0A4AB1D1866354AE578B1344CB62EDB1C696F7223C75B1E079FFE6F
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.6Io....$...........#j.......o..#.E..U.(9....\.8l....m.T{~...............my.`....z.Uh.1...[.V....4.\q....o....8...mJb*.:..|y.0.0@W.;...S.E.d.'.F...0..=..$6.*.......4.l.N.........+..&Fg._.Q-b......W{.r....v'a..A..,.-..v'q.0...3.]......gr...7I-.$.i$.WX...!e...-..........P..f".$X.aE...7.!8.}...X.....n.9..M&Nu../ 4..F..c....@Q..".dp.c.Z....D0.b....&..5-......@............g....&>....q.|q.?.....i..o.R....!6tOl.0..........j..l..&rR.]R?j........*..vm.2#]>.Y4mf....N.X{1S. ......D.X..n.4.>.%f`...Xz...v=.a..>.h...D.-/..}f.M...k.=S.,......!jd..^..4..;.c...#.>tOk~..s...W.......5.:.,>....}.x3..6..4......k....sP.{..p.B4.e....bA.n...@W&S.....`X.B.85H7..J..2.]3..T.....E.s..D..U.h|.4..%.m.;8&!.a.yVIL....9.q.r..!.Z..Ow..7.0.... >..l.[.9@a....\..+...].f..hi.k5s.O./..)....x....U..A.K..W..~.h.Yx~y..._....$..`.4..x.={[.5.0c...q..@....F.~...$.E...:7.,:.j0%{.e...^..._.w..".......Y^9.;...zmD.1.?....R..Ux?y|C...}.f.T./]...`H.[.....'.<...1..<.k:..#l..p.0

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\shield-preference-experiments.json.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):286
                                                                                                                                                              Entropy (8bit):7.2704239152454955
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:ZuxzneSjj1pOv/iDvqgwWwOcgsScMMUnK9Y240pD:ZOzey1g3iWr3Q3O
                                                                                                                                                              MD5:22299881EB30CB63EA7BB0270E06AB10
                                                                                                                                                              SHA1:342EADC0654B512D22BE184DE7686826CA989A02
                                                                                                                                                              SHA-256:18C73AC97D4E97F9A6D9ED2AACCCDC95DBCA0D28B211F49FC8F35B9FF313C370
                                                                                                                                                              SHA-512:62B9498593C895A05AA25C77103CB0D0A7C1571A792983763B9449C4FDF782C80A2EDE4F687CD854352D8A842F61F23649E95871020CE763163184222A28B15F
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:...ck......_...z99..-.........`...Kq5...G...X......Q...Z.#..R..}...Q../...'=..mtM.....VA=.~.^P../.|...W..T.^..#..J.-i.".$A}h....!3.E[&......Z7.1.Q...X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4340
                                                                                                                                                              Entropy (8bit):7.958770644755671
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:sBpJx/ibiddbTYOJRGT3IY9DpBed2JKgYNVKT3dUI+:OxKbid5TQ3vLBJgfNVJI+
                                                                                                                                                              MD5:D5896BDA405859933F2DB2B2F849A46A
                                                                                                                                                              SHA1:FE7880D76EDF68203D16DA9CAD5637E70818183A
                                                                                                                                                              SHA-256:1D5C119254E7A166A112F839401650974ED5D8DA8A46C6006B3CF2919CB490B4
                                                                                                                                                              SHA-512:5FFD4B7C20597C1687BCA67A587CB35DEECC2C138C0AEDD8E91A05C6660EC0C3F297BBDCEEC98F847F0C8542B0555A6C6AB78DF161C3A8252AFE04B43116E94B
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:n.rw.<j.i6^.DM^4..Sh.....vEeHI.T,cY....../.4q.,..4.5....... .B..>..4..H...|......=.....Z,bvu...T..Zo.j.NT/..x%.........E...v....*&....[.$..x....Z..Z..[Q}N..p..x.5.v..w...]..D.....B.R....2......nk.6.#..[...._m"..._....8v....f;c%H.&$.uX.J{@.-..g5._........AI.t......~..u[.....=_....y......k4......0..P...7.7V........I^X4H..........W.^.s.....M......}>.I.8.no.`..a....ng....aH[b..[C.....~..3...k$..d....I.5I..O$K..H.-m...i.m..H......F...).......8;..{5P..."..xOV.hN.Tc....#._.'..J.Z...s......}..h...a9z.$.:.......i.D.Fd..*G...M...k2.. ....._a...G..U#..,.I.R..8.h.Y.'.._...r.A.$(.m&...@..2...x..g..l.....#.P..\....N.Y.r.w..j~?.....W.=....`.....gW.....=.B..-;0WE.^W.K.f/.....l.Y.4O.M!...f.x.y....v.,..Y..;.&H.M...........J..}.=....U.:lz..".Wm.....<..s.v.X. -..1e.....hg....@..2<...Z;.]'U...........^..o.............oh{..?......b.#.k....\.D..y.#._.]m..g....}9....G..1......Ls<..P......'..5V..\...}3Q....!.P.[q.JA%.. .E...sb.h.t."$..H.\.[...{E...IU.Q}..)N

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):131320
                                                                                                                                                              Entropy (8bit):7.998653178027989
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:s5UuLaG6KaKv4n/5A3wuhb3mOVP/NLcd0Af/:syQae4n/5O9hP5cd0An
                                                                                                                                                              MD5:43940FE335EE96DA6F0034798C935F03
                                                                                                                                                              SHA1:6E6C575FC75CB806744EB4222E6B72DBC9C68402
                                                                                                                                                              SHA-256:15C2650D1A236DE0A77C5016FAFDEB65F672FF4B695C88843288B918E82D4FA0
                                                                                                                                                              SHA-512:2D6E5AAF65FB0389C513AF686F0E2A012CAED56CB80D5D322D9EB4C25BA6D906ED571AFF8D5BD27C20156521ECD55C14B34B25AB41D3C8A7F97BA9B10AAB7755
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview: u&..?_.......2.z..K.0\..~....s..f....!..b..q.....A0.J.d.......V...VK(E.`....&'.r...&.zU:?b..2.....DZ.....S....b'..b..qGB..>R7...@O..|.......m..KvuV. n.L..W....w#q..#\.........D.0..)......'.Q.k.&G|......=...{jg.....J..#l..bi.e.F...$.?...9.K.....z$.b.Le?V..d-6qF..A.o.(....s..m..R.J.dE~6H.KPz...e..a.d^...r+....h.y.Q3..c;..k..'.lk..q.?.'"K..F...l.Q0..`.#Z.........1..p.....d/<.%...>5.Z..(.:.3<'....y+&.H..EE....q...L.Gx...>.:~..za.C.3.......xDL.r.2...i...f.......R7...Q"- .A...\.......\WF..<`.......@....u;>y%.e...5#....v+u.`./.X..^....u..V..`....~.....x.....I.q...o:....Xt....r(.G...jKii:...fa..(;.....7/5..BH.....MbW..zR..^.!x....D.g..J.o..I.=......i..f^...........1WRd.[\>.6+A{Iy.E>..O.Tx....VL.....}..p.V..mp..."....i.g;...,..3A.>.f.1Al..8.F.fG...G..d.`.V..)p,.s........!D..2a..t...s*g.L..j...[.a.n..7...d.....2...&...&I.CT.&.....@..G].L.Q..&.Gz...H...u...&-8.r2...M..=n.Pa$G....JJ.h..u...T.Q.1..."._H6,I.|..t2..^...........).-G........6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\.metadata-v2.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):275
                                                                                                                                                              Entropy (8bit):7.215367570213013
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:eVWqiZBt9jPHUHi0C0fSJJH9lmcgsScMMUnK9Y240pD:aCBP+i0qPHLY3O
                                                                                                                                                              MD5:83B6035A3D0FD5A07AD209687F1F3B81
                                                                                                                                                              SHA1:3888FDBCF213917D278A600B64A15851FDE1B9B9
                                                                                                                                                              SHA-256:4AB70C75DA552C7EA06EABFF0AB44C5D4D9B99780D33CDB8726E2C69BA9FCC6A
                                                                                                                                                              SHA-512:006853129393C6D8D1A4C334FB571464A094ABAED0D8E58427DC0B55A8F844B7EEE39BBDA0F066A46C660D2515D7E9E6E42853ED47F1B2469AEF7863BA876C20
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:/....i.C...M.b....1..9K.2.......d9..!............=...$...ct... .$.t..i.....w.b........Q.p..d..uS.I..G.xE'...(.<z8^.F..W......Kg...Ri..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):33050
                                                                                                                                                              Entropy (8bit):7.99385745121243
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:0ALKVEdNaVrDA+XkcU1r6Bu+Oel++wa26fVsvR5G:pBdNArDNXbu+Lc+wa2mVsvRk
                                                                                                                                                              MD5:CC0809DADEA48FC18D5918C45C26A982
                                                                                                                                                              SHA1:933F7A9998B67880632C06700C99DA2E56BB7FDB
                                                                                                                                                              SHA-256:C47A4BEAF71C0ECCA2674CD7AF909EB514E9DB077E6326858FDA56262EAEA42F
                                                                                                                                                              SHA-512:71A54059C8E4E4DD86AE19F35EB65E7253F1A03A448648D839A42C8165FEBE96F9D3DC59D7BFE01B0670E4D1D15BA5828B803F149BA63D5D3B148B568DE144C4
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..E.;...Tf.#.a...2 .1#.(C.<c=:.S.Q..:..NP.~r..Zk..B.`<....J.....=.E...1B..\..z.sN.^.....g..B.......`.u".<t .[....9y...`.B/.b..'d.;.-..7LU.x..2.}>|>.?^...Jg..._G.!e....g..<}..c...iW'..x...J......rF..........H..tq...%o...a...e.c..R.....3........ip....}.w.G.=(YU..!.%..<.^[ .C}*o.....po.4.}..\F..i0.\.-...R;....v..]<..9......*i.:L.._.O..q..y.g.>.....l.,..O.lm....i.x-.Q..!.j.}.kM,...%4..)Z..}.....i.]....W/.....n.sq.(.y......F.H%..w..'.^......i....K.....0.0. [.....[V\../...m;.R.v.....7{..V,D...>.e|6...b............w..&^.}a%M.d....m9R6......3.....Q....s;....0H.>..vh....e.u.KV.`....F.......g).30..8I...M..]..OXE.*.J..|....+7...T`.r.@d.Pzvz.f.=.*.B.{..Hl.._.=...A. .L.x..T.....w...n.F.\p*....~....>.G..I.."..........g..gtX4..$G..6..y%2%xc...M9...-......<.l....;..0z.../.....-}u*+..F`1t.U.....ZH..........,...R8.].e.y..WP......l[.w.]..I.h..R.N!...|.~+.......wfO...q.=:.ez.k.....0......+KJ....H..x..S.T...W...7.Ex.T....A...g..s....V....

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):49429
                                                                                                                                                              Entropy (8bit):7.99606416884146
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:Q0nMYujlO502SL3RafRBr/INPViDpOnccWM5gzklxI0HumqRLOuCCvjVxSgKhNGC:QSljSL3w5F/6VUpdcWMssOGjAV5aAw
                                                                                                                                                              MD5:09C57B61E429C33F0EF67A593317454D
                                                                                                                                                              SHA1:0DE07F9487A85DEABE3143872322B523817390FC
                                                                                                                                                              SHA-256:330CD296B7F1704DD58A28FBC75316C0B43FC47CA6998CF08D851B56E2C61B28
                                                                                                                                                              SHA-512:3E091BC66EB3A817E0AC2CB6930C7ED4FD90F199168F3C82B08913E52DC38C9B5A5685EEB29E538262095E57698D3485129AB1DB51BF83B367C817DB81885F1A
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..Y..=..t0H........$.$GQ.<!)..r2HZ.vi.7c..1.}n..L.f....X~..W._...T.*...,..r..t..tm...0h|.{G..|....0e7.....b.-.AoC].u._....P.I..n.!....#....fZ-....Z...ku,.l8DV..].w..]<.&.....s..v0.Kk...+..A..,....._YX<pc.j..%.....eg..a..{.8t.I>.x;~..r..6...e..y.z...B.5.b..s.N.O...^r.I.......`...k...1.......z..i=F......bw.....(.+...B.V..>B....'.l...1.$.}.#....w..Y.+"0h.W.I.u..ZIl-...../[x.U'.*..ea.#W.pK.N..4A...dhb..:.'3L|.|....;.....EC...Q....A..p!...........$.-.."9..g.....M.x..j....R@.tX...&.@*z........{.Z. .........f..01bO.q.Mr..H.jC..X..W$.>..s......./.,.P]|U.)....pE...i..wH..#...1A......8.oZhvv....G.5r.IG.r..3..I.......U..~SE.:..G..-.xI.a.hNT.n9.2("'..1.S.].,0.Z...s....l.....v;_...X.=w).}.....-.H.>.4.~._"T........6..X....:..F..aZ....`8.).4DO.^x%..I>.p..O.c.B.".p.e...EQ@....M.|Bo../..UM.Q..{...q.[...;.)..L.0.e;T.5.4%.]...M(.V.^w9.W6.Lw.Cz[0..f....i..F.?.....9..duoL...%wv?........_>..X..@A....6.....>.k...v.a...v_..s..}..e....d..X.6...U.=yW...<..

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):33042
                                                                                                                                                              Entropy (8bit):7.99538913290319
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:n1LgwLS8OSlmwQAtT8xdoTNJcnRi7aT1R6+kjY1FwE8ffN+r:nhgwLS8OvCidQX6Riyh4EKfN+r
                                                                                                                                                              MD5:5EE161FF13D65F2A73BC957E45C4F03E
                                                                                                                                                              SHA1:99CA080ED8227ED96ACDEE2A6E3E89E6361CC1BA
                                                                                                                                                              SHA-256:D7C94B1CA6AABC7EF8F4F01B93C0BD79448DC42D39B64626B687BDC0EEEA7938
                                                                                                                                                              SHA-512:738C34F42367C151DB9708F9DE2B146B289563EBAF77C02D52042FABF16CEEB917EE07A15C9829CE8D39BFCB4B1D6268925108581C68D5DFF0170AFF76CBFEB4
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..h*%...bU.g..E.R..5.A91b...U@...Q...N\.Hh..a..'h.=.Z...i.*{..9.D...9.....w.C...P...~...M...2.k.H...e...4Z.......%.2.3z......FJ'..P#..&1Rd.....f...q...l.LS.......9....>2.W..O.$!...C Al.Rv....Vm(1UM...v.....+./@.1.2..c.G:.%s"$>@~.26=..|u.3a.60..D.VA..d.l[..Du.C...>..G.p...+*j*.L.... r*.V=!.Q.y;r.8.:..x....@|33.....r.....:.)d.....z.~...4.>. 0.M.%...G.<E......T-x'.,\..So..$N....n.K.....-....^D.n..WO..O...S!..khkG..P......18...id.j0.O.I[..pW..x....l.$.M].O".....L..BU.,.!.%R.....'/...<u....V.{.dJ.\..T..N.H...A.Nl.}.o?..L.].p.q6il=..%..r...A...Z...@....8d.Z`.4........IDg.5nEasnTC.(.>..6...`.j....W...Z....<..\.Z.H+.......B.d.$...N.........z;.Of...."C.l...._.-(K.Vx.9zf.I..Q#-e..-.r].1.i?m....uC.Y..*...j$%..J.<!k6]..f..S..e...l6.>l.l....$.@~...;peW!T.u;..t.Vsl\K...P..a......Q!... .f...7._...(L..&..D.e...q..#.y..~.J@..;..|....u8.....%...^....0ym.Eh%..3=....l<..=.9..i.8.EQ.....I......%.t3.4...............a.t...lV...}.yo.%..2B....WN...}......`....d...V..#v...:...

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):49421
                                                                                                                                                              Entropy (8bit):7.996326102070699
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:HCAHoS3z18avAeYrHMI6CXMzAH2wfH9r70Fnb3Ap4e6oO+f+HEqn+Fh:HCAHoSDq0uHb6CczuRH9rI3E6BXHhnMh
                                                                                                                                                              MD5:3E18055E75344A8D8F06FBE857C4AEEA
                                                                                                                                                              SHA1:3FCED04DC42005993686BEDE7734CEBC24011EC5
                                                                                                                                                              SHA-256:46C584395F27E822B7CD6F8D3D48749BF775101C99A93C0673B701F79D1CC94F
                                                                                                                                                              SHA-512:D36A8D8001888B278E98094D603E84A1C430098E46B951C0D8A04651BDC3189E1D33D2B45F8074EFADF36E923F57D28377794833DF998EAAC3347854AA3CD076
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:m......".Z3...n..|.wpS!.....+....W.~U..o.jk+....@.[LBK\..}!i..L....j=_@|.O.F.[..=..%.e...M..q...m*.o5..r.R...a..q.. .!.@>..Y......KD..c..<..J.x..7+.......i.......]A.8..y9?...sE.......r..0gb...#P.Gs...8...v7......'.1K......*.iC.l.:*w.......R.g..X...D..^Ld..TKuK'..'9zV.C..h......jx.k...+..s&s.<{.}.....m..V..0...Sq9.Sc2.w..F.)Q...._9........k..}.......k@....B8..e.IGY....=...Y..oJ[XQ.y.[....|X.E./.#.oG..-..2.M...x.../b.FM.D.KU;.\G[.w........c...%...X...!.v..6.;..%.e...YS.c.u.Mx7....~"5J....`....?..G0J..W...x5!..G.a2M..-..._t.c.r=..$TI..F...Q.HV...>>#..*._.....:.s.p...6(!......i'.l...A.....M....."d.d....o.*U.n.MK.2,.....!.$t{'..&...28..h.!..Q..L,/.D..n...;./....4.]&D...W.._...!5.C....Q'..a.._.-.2F.....H.j).?1.B.$9.....6.....1...".....u...+.#.....Ih..S."S*z...0..Q.,...X...M..'Es.xS..[*..]lb..P.h.......C...g..f&.R^F.UE......f..M.'.......u.r.....O...D.L@GG....]..........$L..s>...@...........q^....uE.VkHqt......E.^^.'O..f.....`...!C..S./.

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:OpenPGP Public Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):33046
                                                                                                                                                              Entropy (8bit):7.994292651647446
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:384:P3FRHMYh/2+TPmpmLKGsrVcq7rztTSoV4Ne/VEjKo8gu7uzGlMmkzhVTmVkDHNfg:z7++rgmLL+Vf5uZdjKiGs+4v7mL
                                                                                                                                                              MD5:F28FFD9736B5EDE7E3A3B5E3D5171007
                                                                                                                                                              SHA1:ADE2CE92FA98672B341C4B6F58FEAFAB88144583
                                                                                                                                                              SHA-256:06B79D31EE2E717DCA84A98C82C0A26EA99FD045EDC383A6149D4AAD3D1A8569
                                                                                                                                                              SHA-512:4366FAE1F41E539753B6F8474D6857C55F6C668B34A7016796A02ACDB637B6DF651A8AB5B890F3B16A4BF25E418DD50858477064333FFEFE9B76B95F3E3C8A57
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..O..2g#..t.B..u.wK>.......&...Z\...}....x...c.r.?....7t...{xx.6f].CZ0.=...5.!u....-.+cr....+...-..{q..^.v....S\B.uX.T.).._.....#I+#.c..=.....S$.~.k.pI.z..%..j..w......(..K..g......#..O~.K..0...Z...F..H.'.u.'..g.?l.1.9...|.'.JA........~.....R."eX...UU.../}..m.-..?..E.X~>.kE....'...0...@..1&p..i_#.>.1.pi...#..zXQ[....p.........].P@=].P.,]...u|d../.[5..J|_.R}I(...q....#..+.....P..L.0j........>IG....=+QFtFZ...x...3..M../'../......2...v!jM..q.-w-q.T.PG....,0gq.....0...m.?.....N.l.....X....a....z..X....9.;i....[...z*!?.=.Z....0..&....,..qX....q...'>.......W>.T.\w.^A....c}..b&..Q..(..dN6.{.x=@N...A.....&Z..6......x..)p..$u..v.u..M.g..W4....Q.]..&m....s.W J@666..u..";.9._.......;.V!..x.{_........r2J........52...'.k1.<*..)gb9.w.._...k ;.Y.;.g.QEi......C..q.Q....v.o.......0.....P.K..u.........."..1..N]>jD.(..H..)......>).9v......~.P..ApQo.H.=.-..OC..I.n.j.IpK..$.*....._W......sjZu..{`..kI+$.i .k...:...SN...0....j.t9.`..c..:i.....o

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):49426
                                                                                                                                                              Entropy (8bit):7.995862317094945
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:fGQ89YCw2WaFvjh8H924rbgO/SUCaVHmFHGzAlyBpPCU/JHWYTJrzXKYEpl/zYf:w9efazHOtC8mFlePC8J2YTpmXpl/kf
                                                                                                                                                              MD5:080A76545EE968C31EA91409F9713B4C
                                                                                                                                                              SHA1:B38615D1302A017ADA6B4D7FADBC0F3A08A52088
                                                                                                                                                              SHA-256:F34B5D83759D962C6369FE01A4B841A74ED48108A595FB576C04F9BCA76F63BB
                                                                                                                                                              SHA-512:DBFA1F21F133DB12732D7DACC46E0FFCF9C8A08D12B8CC96A8A5D46B0D0B8C4CA80C8F7E8F62F85D41A8DD058577D6B560B13C947044AB440A3E327362659F81
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:......O ....X.u'..Rg.X;...ua.Ra.V...td...d...K.....F4~].},W..?.C_........l.htwH.W...3.."".\..5...&.f?i)..~c........o./=7E...1.D..c..(...u.}X.......|#Y......0Z.>..T.).k&C......p..6..2Q..1..=Me..1\.....z...K .....-X_..U...(c...@$!....T...4..W...Gw:\.q.e.kF......Y.=..{..B..Jl.R.......8...p.Q\...2.j..xv.O..B.Z/.%{r..JV.(6S.G]..#z.{..t..0#.6.>8..^.>."..l...w].u..9..9B........!.._R........d^ .&.I.....V...X.z..`.N......G.v....U..e...?2;..;....Q.Z.8Q...v.....vs..Q....,6.-......,.............D..+.a&=...bRm..G......[.nk7..,...l..h..>..N....0f..g...Vy....;u..EK..... ..a4-..x......|..l.....a.U.....J..'....Q....+...Z.'u......nR.....C.M2......*.MV.........A....~..v_........*c....~.V.2E.{.H..~.........7.&.j..K..d%..G.d&&.A..J.'..p.v......Y..<........C7)>h..T|KK...+c.}.V.W)R:..1f.....Z.O.9c..M.={.K...{...o..z.!.`#.T.*.t..U,..a.......E.K...u}...nLd.{.M.E...QS....n...6....l..7.-q....*C.%..c.3/..%.-....m+..F>9.......a.%:..K..........%.............

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):33033
                                                                                                                                                              Entropy (8bit):7.994492330714626
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:vxt2mPG79zyXR+wqw3gbMrdGJAEsYbPkR923JZrfciLmauZ3vnL0:vxJG9yTqCGf4RU3H1Lmnj0
                                                                                                                                                              MD5:79BAA219BF124193BFA7D26FBAADF649
                                                                                                                                                              SHA1:D2A97D691B7803C5D6C3EE1A81070838C6722C7F
                                                                                                                                                              SHA-256:1236B1CC00C606C7242BB3EF94625C944C565AE0EAF4539F6ECE4A2398A7FC6F
                                                                                                                                                              SHA-512:172F46029C137EE2F5C4FD36566EF40843B69B0354DC218009B54147E98310AA9687B9D645C09A8D9FEA2C72CAB414363BEFDEC78217974BDD0716D07198E3F9
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:....*...;.D&...q5bQ.h.g.h..`&.4...A.[C.......et.h...~..1./_.X.e.d.n3*...|.Z.B.c...c{.!.v......nmG.@1..........f..i.. .....!.!.........n7i.&4.w...H...q;..U..I8.8..O.t.!.Io.*.%;.h.....P!Ym(...Y.r!...g.f....g...E.h...Z...:.._.2c......e..cR.....\...nuy..@..|..B.t....CC.o.k.....5.3...^.... ;y6....~z...]<....z..}....h..M...Px...s.z....\.....,l...'.%.5..Q.<.]..O,b...E......y..w|.K\t..\D5.W$T^....d.).b..h._%zI..TmU/G....G...X...].]..%jp}A1O........6.......e~[......3Yh&p`.M..M'.9....\-'..;..o0...Z{(.~....c.3.....o..|.v.!.]........nX-.VU..?....z.L.BJB({...........i.%..........W...0..f.8..k....5.(l.,&.........(..&=.-...XT.sBU...}.3.......r7.Ip..o6....(...T.)..h......w...H...d..~W...gs...Wp.lV.]0.e..6..........\.......#.....qv..&..lN..._H..e9>.Pj..TCL.}].i*......?`0A...*iP6.2h.....0F.af..ij5F..K.m.\O.....J..k......5|....&.?S.H..3..f_x9....J"d.v<.Y.*..c....S.;..-.... O....i.r2....=)p.s.^.L$.1....&..g..2..##...E6)..>[.Qq..&.Q=K.H..R../...........{..

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):49412
                                                                                                                                                              Entropy (8bit):7.996786802467779
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:1536:tzLlbAnDAyPQSb6muEEaQNReDCqbFFRSIP7st:tzV4hPQa6q1eReDPKbt
                                                                                                                                                              MD5:1DDD09D5A8DD8BEE4622DFB97639D506
                                                                                                                                                              SHA1:F6A0266ABDE61A7FD4D62C1F6910299A86092DD5
                                                                                                                                                              SHA-256:DB92B5B23EFA2A53396562DA6B74C7AF4C35F202A8E74FD14AB710A3A155E72C
                                                                                                                                                              SHA-512:BDFD9C9C9DAE3CDC50DF690C8B1BC4D2316302AC3089F771C29004C7C6B44A2EA77C5CCDD7DE45FA9F00E4269D437E0B65B960D225BCCA7FA73242B4B6114A35
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..._..9.....D..QyG]s.{.].3..y.....U.S..)N..M..g{..!..14B.h...y?..S.G.....eV.&9e.i5`..H..g...].p.N.....B..0.3.b`.......i..O.<`.7v...p..w#..m.... ..VL.=..P....e.mI$.H..O#@.'..:%.....p..K-+...T.T...C._.ll.;.9L._.U...:Cr.^.Z.R..|.RKA..U.`2..'.f.P..P...AF..K6cu.jz.ruk.v..T..2.t......1.....{rK..,..iQ"...I]f|..B.|...X.......w.;&.Ev.N.....-..2...GG lOv3.E..U.........-.cR..n...d.E..m...."..^E...4.......%5~..._..vW..z.%T?R..2y-).#`..j..m'..*.*..I....J...b.7..|[d...%.J....U2.^.8"}.1.o.OJ......_{._.$..k.}~ns.5...)..S:.t....f`...=YV]...=4B.1..b..P.D7...f.......z.W..!.....u.....h.K.........U.<n=.N..aa.T?.'.EO[$d.FF.Kg....|.-.y".....y.y...$......5B"........a6...X0x3}j.W!%m....LJ..O....>....."9.1.^./.......H.*....I..}X...B~.a....d)..g.E...DV....aj.c.E..........*....R..g....&... ..$!._R5..{.]4L..z.1..."(..W..w....b..5..E..4.|'..u...a,>.R...Q.^.n.h..P6........g.}.I%f!'........;...>...q.+Z.Z.M{3.n...@....@..'v4..;...AO...0.`b{...YO.(.m.@$..w..X...]r..%....L.g.<.

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):33029
                                                                                                                                                              Entropy (8bit):7.994918611533898
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:nqQ9dd2qNqcDbKRTAaoFSUUHDxBAG5YNZnsz2DTTsdlab:qQd3wYekauSpc3NZsz2Slg
                                                                                                                                                              MD5:F4D88CDCD568C6E7DF34E32D29CA401E
                                                                                                                                                              SHA1:1BEA1602BA4934D70C1C6F1868B66DA4863E77BF
                                                                                                                                                              SHA-256:04C4DD16B6BBC8A5C2B7210B539AB06C0CAADEF7326ACE0C12C51FD17C682685
                                                                                                                                                              SHA-512:8E9D5F48580A57E43BF716947EBA86F0614865F0DCF05BDA378F5A0A4938841D85D7A068D4C1D534F21729AC5785F8A88AAF4D3828A788974A873D539246AE61
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:Os....e.Z.-.x.o"K.E..........S[(..l....u.j\.~...(.......Z..5I.(v..$....HJ...$.<@GcE...)......S ..b......9.tp...'.:+...d.f.H.....o:....i).....bQ\{C..e.b.}........,..xu7..23......w-dr.#!....g...N.zIZ+.R....jF.....T(.5#..[0......WZJ$..X.I.......%.....i9....jU..e.S.{/.Sp...,.......Z.*..K.'<......?..lP@X...?.sL..0s.@uG%.BP/9jJ.|.H.'..Wt|f...:..s.3:=vZ0..Tw..........."..a.{}j.5 5.:...".....+.l..t.<T3..B(.D...j...-...............n......,.......w..:V.........K.I...g....q......s.X...0....v.....jH*.Z..............8a....,........T...P.%.C.e.g....U.1..A...~8....'.}%......5Zim.U.m!..D:.w.l..b.....\.u..r.`.5.#...OF.?.\\V#..D. 3k._...:].1.jt.oC...~...T..N..$...z.....D....T.1..w.[....Sr.m..|+....#.7.a.....5X...7..'N.1.j..6r....`9..(.m%pC.7@.DuX,...t...iiWu....y.<...r`i.....I...^.k.%.o.P.....}..2........d.g..rE..`.8.;...W\..b.&U!`..s..G._..z...L:><...;..5.....d..C.S....5........c.f.U.O.MI..^.r...O.S8..H..w..I.^..O.[){..~..q....s~.K...j...kw........

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:PGP Secret Sub-key -
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):49408
                                                                                                                                                              Entropy (8bit):7.996214073833706
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:1536:qhkkkCuQqb30j2KwV41Cm3/drcra6a/7ggonYErc9:qjkNQtj2Kwa1l9tpDMy9
                                                                                                                                                              MD5:9865F3CA694BD0EA6FC19DBC08C4EB5E
                                                                                                                                                              SHA1:784FB6750ED9992FE82EF6B49EC7D49404554DF0
                                                                                                                                                              SHA-256:F63BBA5855E9F0CCDE3F51A435C556EF093A1D5CF0CC072838A96C7A8A3C3CA1
                                                                                                                                                              SHA-512:A136F891204051258EB135A3CC7795386FEAE0460732DAE8A6F2562FDD0265DDDAD9A06EE4628FAE498DA6FF0D25896014CBB8040CA26653EFEC9594FB378B78
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.b.x...Yl..........D.\ERN....P..m.zY.....D.. .x.......06.0{...J".A......\.....f..~I...A5BlS.+I.>.V4...!Es....z.%...;..V^..e.....5#..U.]j....(X.;......W.'.. X...s8..CM......w....O.O....E.x..u...=....l"L.#..L."L..\...].....kj=b...:...m..Z..l....J.{...b.8C..k?!.G1.V7....B..m...8.Pg....l.tp..O..7......;..........#,.V0...s...N. ...l?.j.L.,...e.Y&.y../p..`.....^..!r.;.i.m.$?X..X.f.I..J?..iI.#.f..w.....%;>..ft8.K.2.........^...i...Tn..}it.a.;D..K7..J.h.E..>ep.?.2S....R.(.|.M.1.M..vX?{VN...[0.X..Z.x..O....Ao.....Smt..%S..C.q..!..b.8.....9..9...W....w.......+......+u.(\...........O.>.!...1..Ji9k.(@.x..N5...y.eZf9.x]......{#8^..[}._.@......S...R.+.=`.{__.0.n.AM.*.V@..|.....lf>.2..=...a...H....,.#.Z..8.C...j..Zji..\.\../......8 ..H7{..+.'...r..N7.O!..F......^...Y.@N..=1h....^.<..A.....)..53r...?yl.3...U..s,.F.R.....6.oB../...%..Sy.t.*Z.S.........c_W9g.n.5.r...N....~.b..L.....^E.B........?....o...!'@..G7g)J._.ZxG.d.#.^|$.0..Xn.....a.ifr0y...

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):33042
                                                                                                                                                              Entropy (8bit):7.994831460113585
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:xJmMUhuVolQmC4MNYsuvRrPI5TEMiM+o0cxKJYbA8:xBwAeQmuNYxA5IMz+kxQoA8
                                                                                                                                                              MD5:FB241E1554259C2D2118243C77056EEF
                                                                                                                                                              SHA1:99427F1AA53E9873BD22BBDDD26956896EF964EE
                                                                                                                                                              SHA-256:8AAD106DE7223CED5CA0DBF672DC7F89C418D8B4BC26B8EF1E44195A263C2455
                                                                                                                                                              SHA-512:05D2FA2F540664E332C976B821AD066C69D1267E8FF9A1DC31752E39A66D35B0A752A122918CA2134B55D37BA90663B88087A826CA7E6CA3D8930CF8533A02A0
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..g.Eq..)......M9m..&..M...~..A....w.).p..z.T.y..Y.jz.........}.,.y..x.?HB..M.\t..d..0vz0...........t.C..... .En...3.....?<O..%...:...r.=*..T..?.{. ......W.F.O....SR.Q....g.7dz..T3.{..R0R.N...V...$j.+.pM.:$..W.Z..|.S.aj.T..)....mg$.P...~..#T.B..h#.dF...djf..h..Gi`.....n_.Hf....AKVL.l....r..~....]'......I.Y..Yd65..C.@...l..W...6..K..=...e...A_#.G6.......I...n^I+|...Q#..F.p.-.m..$....ca..AF..G...O..[..1......t..*.?.\...3.5qrW}.=\.LW...eP..-.*...o..J...I.-&Y.E....$.L2.....s....}*L8....1......'.N+........a...........N>3.........Q......!..%.S9O@...llf.....[..f..s.(2...|eE.J.A|%..`..P..Q...^i..n.. .H(E......I.+..4~..=y.r....._K.T`..n.|.......Yce...@fb......#_...G9...f..aAsL......n.6...Z..~...N.[..`.(<.q..~Sz.U..(^O.Omk..UO.G..f.b.Yw.!...v..#N..=..Qu.Y.H..6hE....a.7`4.......$..e....iO....Z...I.H...,....j..e+....8Mh..Q...4..y..'.v...P.....c.X.+&.\.W...+.0>....{U....xQ..li_....|..Q....:..?..o.2....Z..Q1....Y...A-A.m.........V.3..J].T......;.T.}.r--

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):581901
                                                                                                                                                              Entropy (8bit):7.79170918388915
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:EjG9CXPuJf/CXX0PMiMz6sE6wHfG8MWIjUuX4h3sIrAfQf:EjsC/uVa0PMivsNw/KjUuXc+fQf
                                                                                                                                                              MD5:23FB5E29EFACCF7B1E2432D1FCF2B3AA
                                                                                                                                                              SHA1:11776306D54EED44C8DD1245FF0E138BD1F2C6A2
                                                                                                                                                              SHA-256:4D343EEB6AADA48D6CE21F8ECCCC9745983C837487141DE51D23DC82CB13E71F
                                                                                                                                                              SHA-512:5BB0C77750F1B8BA46693A08D36B36F4C4C24D60636C32D49D46CF59B8B18F256196423FF8439A1C1BE0DDA42EEF7FABA26B8DEBD7D82175E954476A4BF5942C
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.....y?..K.}.....)zm...-....Z...f...V9..V&..%..\$...*........[..A['....&.#.U=.Cc...2.oC..8.R.W1.T$...JLvA.i...=.e....48|..=.~.o.%.../...B..8.t5h....W...@.&.B..b.$...<3D...T..Q....j..Gk....W..'...M....._......."...!..Ue.O~\..u..v...di...kP..c..oV.27L...../.-....*.6%.l.,.0.E.......9.s....%...$..y..8..@..P_\..(...v>......mCR8V.C.-.4.J...)n..)k.[Q....m's._1.R@H.).C..@..j.|.... ..8.x.7r...Q+..n.......M..Q.4....R.q......%.Cv...R..s|.....#...3?J0(VB[N...U..Fq..8......B.7JjK........4.W.Mp.B.....|..B...\ K&x.h.,..'$.<.....5..@0."..\r.....i.....J..O...8.P7.........x...R<.N.T..\..'..]dl..T..U..zG.n.d....g>^..K"V.7z......)~V.%..%..&>ZEpj9Bv..i..UMp.......8....d.`T.'......4.@.|u..~...~.c).w:....g....@>..&-A..gP(.....b3H.Qe...d....v...........c.-....s...c<...O.V.xv.c.<.).x....O..(>$*Rg?..r.....cr..l3$D...6......N.....A:R../Z(C.r-.5.^....e...|.^]....|..o..D.]]T..[^m?./.W..1.^......;..].L..4.c.3...+q.".m...@-.;.H.p...qug.a.o.....8...sd..12...N..ws..s...e.>..;~

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\temporary\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\to-be-removed\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3940
                                                                                                                                                              Entropy (8bit):7.95300672979268
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:Kf+2h8Rl41r6bXvvPeJ1Cvz3AHaGaZuGEaI+VkHpmC2dpM+:KGtRa1ruOvuzClKuNaRc+M+
                                                                                                                                                              MD5:DFF099A0FFE8AB789D57B60F129CF01F
                                                                                                                                                              SHA1:A7050EA15E5175ACFDF28DA9CE7F7C3EB0166383
                                                                                                                                                              SHA-256:457399A306683E19CF2876AB743448AD1F8A818E53DDDB313A45CBFE7061D703
                                                                                                                                                              SHA-512:569FBF2BBBB43671630E22A84F1AA556E63C838C9D6754C8A8EB49BDF9E97C392520B492BB2A692CB13D503383355BAE4A1F641C12052A0B756D75B99644CAD0
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.61.........V..P=.{.H....E..FV].*.oh[...|6...........Bo.6....`C..RY.hE'0....,@.~.]E...6../L6\.GF.R.>..%....k}....N..o........&S..?.2v.....+.....b-...R...S.5..ZD..h...@....:.-..Y.....q.Eg..l....CST....K;T.;.p....^._2..i..`-._.....l.I...Z..' N.T..Nnh..+..;W..di..EB..`......L>.|K.]8...e..0@.=.`q.8c.=C...m8...?T......E\\.KRN.NL...*|........T.S`3.-.x.......5.X.P+.*.....z.....Em4';.By..h...c..........B..M?....x..$......oO..#a...\+k.........V...i.gv..[/.(D..2.^..83..v{J~gF.."....V...O..gX......+....s.....k.U...5+.7.]O..................b.../.l.-.#].4.(.h.....nH..|.....$..C3...;?b,...*..w:v.v.....5..T..R..$3......O.....;9../...#.....ag.].0..6.=v..0.Z.K.U4v.*.;!..e7...d..b.^...~..~2..p.w;3u.]K.L..n.+C.>.N..m...q>l......9...FEC..o..K.Y.!.^....c.4...f..g.E.3.<%.b......F..J/...X.....q.zd.J.&.z..rR.r..h...a.e0.PU>..#"..O."2+e.l...>...........R/._..n..!.*Yc....b...,....yy.1..f/...".>.Js...P.[g|$!.e7C.p...E..*.6q...Y....j......C;Y..)'`..7.....W..

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\times.json.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):288
                                                                                                                                                              Entropy (8bit):7.23293667663178
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:HmqTDfVGg0HxlVvCvzA2uzVo7KL5zcgsScMMUnK9Y240pD:fNGggx/av0tBo7KL5t3O
                                                                                                                                                              MD5:1413C9735F49B9028B8BA568DB0E615C
                                                                                                                                                              SHA1:8A43FD0D4D7AA82A551A27B075423120CC5990D8
                                                                                                                                                              SHA-256:0A723409B3DF4AA49C3E6907604272C86987FC289143E2201873BE28DD03A7BF
                                                                                                                                                              SHA-512:A4C65AE48D218A92A3CD281688CBAB7EBFBD566AA1A7D7730B8098E61B5A3A6D9268AEFDE6C4893B3B99EA37338DEE0A5848AC4E49B82AAA388F8259C10019A2
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..x...@4....O..._...v.....E..x/j).1.....~=...o.>9..)......)..%./y&...c&... .'.t..i...!..x.%..._J..V...}.v..n.=..."....8t..e..6WJ..^.....i.%.EQj.h..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-shm.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):33022
                                                                                                                                                              Entropy (8bit):7.9950144219509856
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:jgFOc9oPbYiwfQrk0s3DzFdKaeCvIwKcP16xmcObzU8VKejK:jgEc9o0ifo0Q7KVDE0ObzUm/O
                                                                                                                                                              MD5:7C6EDF973B2590445991C3F36B838D8E
                                                                                                                                                              SHA1:B6429C51069712C5AF87B1BE18859D2EDA7E417C
                                                                                                                                                              SHA-256:163B32B56161E58B33E5D6789F3C0B21C73E7D4A7B89483E358C424A21CF3E8F
                                                                                                                                                              SHA-512:4AE7742D32DDC181130C0D77A5E0C41130E4B7E7037FB7ABBE8C23320BB3F25369E2555AAE92225FEF23FCB2BCC17C859E15DE56B90E27D1C6E7488F59DF0C15
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:....B>...vy..Bq..I#9..............qN.n.g^1X ..!/..1...tl..#...g.kr1....3... ...5...V......0xW.....zc....L}........{..RK.%7.....'a...>...m..;.."..~.5e..b..d.Z/.1"...-..(.8`5..8..0h.~.U..cS..........'.%....^.........6.#...siW..L.I9|........m.U axC~RUV.Xk...b.r....i...Uygl2K..M.........;z....>.,F.z$3..-s.t.....qxY....a..4.........R.......S.8.....2E....LqmF.3.W..:.l6MZ.Q0lO..5[.t]./..h{jI3B...nSc..6..]r1...Z..o.....2..y.5J,5/......5 q...8I....Ty...c...U[.'....}.,..W....U05...R.Eu--..E......W.?[.3.].'W...AHy.>,...5dV........RI..9...w.).;.!...;s..l.g....1.B......T..dJ...{...-..s.+_.pr{:.br...@.W: ).5.f$!Z......'>.g...0b9....b.....O<.vjq.T9B)......g...n^....\..2M.1.n.}..)*P..a.. ...`2...._...H....T..tH...wj.JO.(.?..'z.w.1._5...W."Q.....-Ra..N.4p.U..Je...&.".(.....m....c..&h..A...":$*\..q.c...~.V"ewA...Di.3.$."b....Lu.LGubfU.).eZ....d'...7.....B7....9Aw.J.#..gyM..P.x.1.;F|m.....B.P.E_.\.....V........`..B.e$$.l9'.."@..c...Qy....{~.<.]

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):98552
                                                                                                                                                              Entropy (8bit):7.998263072847193
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:1536:HVd67v5KvbUT67w2Q8xOe2P/t7870OH36PF3BLeK3W2Dnv+ptAQx5240O6THqfxf:1dsrl8A/s0OH369p3Wi+vpi4t6THAf
                                                                                                                                                              MD5:B4177449F49B4FF5B15625D61DFA49F4
                                                                                                                                                              SHA1:806644178B4B5B60D51D7FC1C0F95B35FCFB7372
                                                                                                                                                              SHA-256:B499FBC1843A39144785207090AB5B5AD3E39DA2390244E1185C1C3F8EA63F49
                                                                                                                                                              SHA-512:89950DE2307420D07F368E52F233073B7B3916C8E912BD2D1F0F7C6DBFAA1BBC22CD9F4E1C3F6D26FDDA760F65DC8623E813E2B0926EFEAA2211FA075205B4D6
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.Q.].3$....ek..-.S.../.......,3@./....7<......+a.=..ls.\.[.......lxb....5C..f7j=............".o...1l.7...=p..._..@.g.C.o.nC.B.....$c.88.g.FGf.....c.|....;.G\>$...,...{Z.R..}....X.8.ZT.X.Z_....f...a.U.y....tY..x.,....+{.t.b.UI..5i.....W.h.,I.xL..'~_...K..P8..2...VG.2.c......2.....%....$.D.l.)...oi....x..X<....<.."m....a.@.......8$.q.^.Wk.9...F+9.W.YD.'...[?/b.LB.kS.. K..........D.2.;B.mN.....LQe....H.......E:.a...+...%..1.m]..^.W.s.C.%.<.A3x...8eX....1w.d.$.^..7.w...B...z.I..GNT...t..9Y..".z'X7......G.......2~oI..7Z..BR.$.&(q.Z..9.N5DVFX.o.`.k.?..b..../...i.LAW..zO U"'....D.^......X.0.....b.qG.B.@v..b.".D,.......@.[..zG..^H.H.v.......?.....BK..b....q.'..)'u,.`...?..../..`..r....C..= ..e...65....mF...}u.}.A..........1.*....5.[HG.N.Dw.T..G.....(V...s=.[..z........(j..t....d.....7.5^.-.. E....u.77}.l.........*...q~.....3...b:.p..ts?X......0.....U9zR................yr..h. .....\...i8.........S...r.=......p.....,..s......Cy....

                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\xulstore.json.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):363
                                                                                                                                                              Entropy (8bit):7.426910063267741
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:mOqMJMRa6rnB7FqxDcstMOcA6tEp3e/SMSbGZFUEZ9L/cgsScMMUnK9Y240pD:5BJMvnsDMOcvtEdoqbGZnDt3O
                                                                                                                                                              MD5:14BC6C9899CBCC1F15F4DEFBF07EE116
                                                                                                                                                              SHA1:C3668A09CC109DC40663726A25D84EC5AF8630B0
                                                                                                                                                              SHA-256:66A6D137BA167F1AFC3407058B520F54B30076CD3F1F9EF63000BD4AD5423EC0
                                                                                                                                                              SHA-512:71EA9FD29EC712AFAB77CC5CC3E2134C900AF73063CEF6D2AFB140E574DB9177D6761940C79A0C2338F0B5F31868EE5D9C3CF554DC5731FE0FBD6A1E5BC7232C
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:a*..t..n8...9CC.^..&.I9V.e.P....;.....C..At?..*:.....wC.....![.S.g.4.^...._.]x."c.k..b.k.x:$.bk.({. k.m)Qj/.I.=.....29..(........`....d>sduat... .$.t..i..{t.IH....2.`.LX..Z..l....6.d...T.Q8+u......!..Xs..]55.6.....;<`a..!m..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\AppData\Roaming\com.adobe.dunamis\56079431-ea46-4833-94f9-1ff5658cdb1c\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\com.adobe.dunamis\61f56613-c62c-4b17-84dd-62b60d5776aa\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\com.adobe.dunamis\6d9d9777-7ded-4768-8191-9a707d72b009\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\com.adobe.dunamis\f2eb6c79-671d-4de2-b7be-3b2eea7abc47\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\AppData\Roaming\com.adobe.dunamis\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\Desktop\AAAAAAAAAAAAAAAAAAAA (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\ProgramData\D448.tmp
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):199168
                                                                                                                                                              Entropy (8bit):7.997206186701459
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:YFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICo:YlfkaKJ50mylfkaKJ50mylfkaKJ50myl
                                                                                                                                                              MD5:C5926FE8EBDF01BB456FE640C1EB3364
                                                                                                                                                              SHA1:669009FBF8A30AE2D8FE4373FB35098F3D137F4D
                                                                                                                                                              SHA-256:E5A1A8B017A700A350EC9B30D4F86748B08FE5C1DF4FB13C3B7EC5BC99E1E7D7
                                                                                                                                                              SHA-512:372E8720D82B76DFEC41080BE51F60BF19575958526006974D6DE3C7A7B87C0744E756C837AB7AE43005845150BC3B752497193BE7A7CC8C04B47794F9A69DDA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:U.F..5).....C..!...#.T.%0v..wl}.....J/Zs..a?..."....ui<....M...^...%..7.-T...p{..7_x.(].....QX..B.8.*...,'..z0.....l0.+.....Q......."....;.M.RZ.)..v...sMV"C.1A.N=...K.:o[.].....\x......#.G.=....0L.f..."4.,.9.....l.eHb.=#3.S.....(.m....s...Q...{n....H..<..O..E\......<.yE[CTQ..7QlA.j.].KX...5Y......8?\.H....".]..m.]e.@..*...\...LC.S._...Z...>.....U.....}......vs.JYGM....._.rNw..E......Ju.~.O..]Y..dm..O....|..Y..Xa.z.e...6J...i...)...a..............B?9..o.......4.........'..|...&.^~....`.+.t0..J........Bo...s8....K]Yu3b.!b.'.".a.t..J.. /hk.J......J.q...h`SXZ]...(.......U-.9...$.0...(..b..~......v..D.2z....X.w"}..w...v.Y.0..r.. .....3.....".t...T...>....G......._.@..!....R.......i.....u..F..cC.I...[....$8...;...4......,....N*.f..P.S..o....u........C.....,.v.v.....t.Xa.m{..4..|....j.xVk..{...@..5..."........V....w.._Y|A\..J...o.....g....y.z.r..$...y.J.sY...+`.|.B];).:...;..q......7.....U)..S.K...K.)PoIj....M...:C....s....T..=..8.R3..X

                                                                                                                                                              C:\Users\user\Desktop\BBBBBBBBBBBBBBBBBBBB (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\ProgramData\D448.tmp
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):199168
                                                                                                                                                              Entropy (8bit):7.997206186701459
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:YFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICo:YlfkaKJ50mylfkaKJ50mylfkaKJ50myl
                                                                                                                                                              MD5:C5926FE8EBDF01BB456FE640C1EB3364
                                                                                                                                                              SHA1:669009FBF8A30AE2D8FE4373FB35098F3D137F4D
                                                                                                                                                              SHA-256:E5A1A8B017A700A350EC9B30D4F86748B08FE5C1DF4FB13C3B7EC5BC99E1E7D7
                                                                                                                                                              SHA-512:372E8720D82B76DFEC41080BE51F60BF19575958526006974D6DE3C7A7B87C0744E756C837AB7AE43005845150BC3B752497193BE7A7CC8C04B47794F9A69DDA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:U.F..5).....C..!...#.T.%0v..wl}.....J/Zs..a?..."....ui<....M...^...%..7.-T...p{..7_x.(].....QX..B.8.*...,'..z0.....l0.+.....Q......."....;.M.RZ.)..v...sMV"C.1A.N=...K.:o[.].....\x......#.G.=....0L.f..."4.,.9.....l.eHb.=#3.S.....(.m....s...Q...{n....H..<..O..E\......<.yE[CTQ..7QlA.j.].KX...5Y......8?\.H....".]..m.]e.@..*...\...LC.S._...Z...>.....U.....}......vs.JYGM....._.rNw..E......Ju.~.O..]Y..dm..O....|..Y..Xa.z.e...6J...i...)...a..............B?9..o.......4.........'..|...&.^~....`.+.t0..J........Bo...s8....K]Yu3b.!b.'.".a.t..J.. /hk.J......J.q...h`SXZ]...(.......U-.9...$.0...(..b..~......v..D.2z....X.w"}..w...v.Y.0..r.. .....3.....".t...T...>....G......._.@..!....R.......i.....u..F..cC.I...[....$8...;...4......,....N*.f..P.S..o....u........C.....,.v.v.....t.Xa.m{..4..|....j.xVk..{...@..5..."........V....w.._Y|A\..J...o.....g....y.z.r..$...y.J.sY...+`.|.B];).:...;..q......7.....U)..S.K...K.)PoIj....M...:C....s....T..=..8.R3..X

                                                                                                                                                              C:\Users\user\Desktop\CCCCCCCCCCCCCCCCCCCC (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\ProgramData\D448.tmp
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):199168
                                                                                                                                                              Entropy (8bit):7.997206186701459
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:YFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICo:YlfkaKJ50mylfkaKJ50mylfkaKJ50myl
                                                                                                                                                              MD5:C5926FE8EBDF01BB456FE640C1EB3364
                                                                                                                                                              SHA1:669009FBF8A30AE2D8FE4373FB35098F3D137F4D
                                                                                                                                                              SHA-256:E5A1A8B017A700A350EC9B30D4F86748B08FE5C1DF4FB13C3B7EC5BC99E1E7D7
                                                                                                                                                              SHA-512:372E8720D82B76DFEC41080BE51F60BF19575958526006974D6DE3C7A7B87C0744E756C837AB7AE43005845150BC3B752497193BE7A7CC8C04B47794F9A69DDA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:U.F..5).....C..!...#.T.%0v..wl}.....J/Zs..a?..."....ui<....M...^...%..7.-T...p{..7_x.(].....QX..B.8.*...,'..z0.....l0.+.....Q......."....;.M.RZ.)..v...sMV"C.1A.N=...K.:o[.].....\x......#.G.=....0L.f..."4.,.9.....l.eHb.=#3.S.....(.m....s...Q...{n....H..<..O..E\......<.yE[CTQ..7QlA.j.].KX...5Y......8?\.H....".]..m.]e.@..*...\...LC.S._...Z...>.....U.....}......vs.JYGM....._.rNw..E......Ju.~.O..]Y..dm..O....|..Y..Xa.z.e...6J...i...)...a..............B?9..o.......4.........'..|...&.^~....`.+.t0..J........Bo...s8....K]Yu3b.!b.'.".a.t..J.. /hk.J......J.q...h`SXZ]...(.......U-.9...$.0...(..b..~......v..D.2z....X.w"}..w...v.Y.0..r.. .....3.....".t...T...>....G......._.@..!....R.......i.....u..F..cC.I...[....$8...;...4......,....N*.f..P.S..o....u........C.....,.v.v.....t.Xa.m{..4..|....j.xVk..{...@..5..."........V....w.._Y|A\..J...o.....g....y.z.r..$...y.J.sY...+`.|.B];).:...;..q......7.....U)..S.K...K.)PoIj....M...:C....s....T..=..8.R3..X

                                                                                                                                                              C:\Users\user\Desktop\DDDDDDDDDDDDDDDDDDDD (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\ProgramData\D448.tmp
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):199168
                                                                                                                                                              Entropy (8bit):7.997206186701459
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:YFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICo:YlfkaKJ50mylfkaKJ50mylfkaKJ50myl
                                                                                                                                                              MD5:C5926FE8EBDF01BB456FE640C1EB3364
                                                                                                                                                              SHA1:669009FBF8A30AE2D8FE4373FB35098F3D137F4D
                                                                                                                                                              SHA-256:E5A1A8B017A700A350EC9B30D4F86748B08FE5C1DF4FB13C3B7EC5BC99E1E7D7
                                                                                                                                                              SHA-512:372E8720D82B76DFEC41080BE51F60BF19575958526006974D6DE3C7A7B87C0744E756C837AB7AE43005845150BC3B752497193BE7A7CC8C04B47794F9A69DDA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:U.F..5).....C..!...#.T.%0v..wl}.....J/Zs..a?..."....ui<....M...^...%..7.-T...p{..7_x.(].....QX..B.8.*...,'..z0.....l0.+.....Q......."....;.M.RZ.)..v...sMV"C.1A.N=...K.:o[.].....\x......#.G.=....0L.f..."4.,.9.....l.eHb.=#3.S.....(.m....s...Q...{n....H..<..O..E\......<.yE[CTQ..7QlA.j.].KX...5Y......8?\.H....".]..m.]e.@..*...\...LC.S._...Z...>.....U.....}......vs.JYGM....._.rNw..E......Ju.~.O..]Y..dm..O....|..Y..Xa.z.e...6J...i...)...a..............B?9..o.......4.........'..|...&.^~....`.+.t0..J........Bo...s8....K]Yu3b.!b.'.".a.t..J.. /hk.J......J.q...h`SXZ]...(.......U-.9...$.0...(..b..~......v..D.2z....X.w"}..w...v.Y.0..r.. .....3.....".t...T...>....G......._.@..!....R.......i.....u..F..cC.I...[....$8...;...4......,....N*.f..P.S..o....u........C.....,.v.v.....t.Xa.m{..4..|....j.xVk..{...@..5..."........V....w.._Y|A\..J...o.....g....y.z.r..$...y.J.sY...+`.|.B];).:...;..q......7.....U)..S.K...K.)PoIj....M...:C....s....T..=..8.R3..X

                                                                                                                                                              C:\Users\user\Desktop\Document.doc.scr.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\ProgramData\D448.tmp
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:modified
                                                                                                                                                              Size (bytes):199168
                                                                                                                                                              Entropy (8bit):7.997206186701459
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:YFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICo:YlfkaKJ50mylfkaKJ50mylfkaKJ50myl
                                                                                                                                                              MD5:C5926FE8EBDF01BB456FE640C1EB3364
                                                                                                                                                              SHA1:669009FBF8A30AE2D8FE4373FB35098F3D137F4D
                                                                                                                                                              SHA-256:E5A1A8B017A700A350EC9B30D4F86748B08FE5C1DF4FB13C3B7EC5BC99E1E7D7
                                                                                                                                                              SHA-512:372E8720D82B76DFEC41080BE51F60BF19575958526006974D6DE3C7A7B87C0744E756C837AB7AE43005845150BC3B752497193BE7A7CC8C04B47794F9A69DDA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:U.F..5).....C..!...#.T.%0v..wl}.....J/Zs..a?..."....ui<....M...^...%..7.-T...p{..7_x.(].....QX..B.8.*...,'..z0.....l0.+.....Q......."....;.M.RZ.)..v...sMV"C.1A.N=...K.:o[.].....\x......#.G.=....0L.f..."4.,.9.....l.eHb.=#3.S.....(.m....s...Q...{n....H..<..O..E\......<.yE[CTQ..7QlA.j.].KX...5Y......8?\.H....".]..m.]e.@..*...\...LC.S._...Z...>.....U.....}......vs.JYGM....._.rNw..E......Ju.~.O..]Y..dm..O....|..Y..Xa.z.e...6J...i...)...a..............B?9..o.......4.........'..|...&.^~....`.+.t0..J........Bo...s8....K]Yu3b.!b.'.".a.t..J.. /hk.J......J.q...h`SXZ]...(.......U-.9...$.0...(..b..~......v..D.2z....X.w"}..w...v.Y.0..r.. .....3.....".t...T...>....G......._.@..!....R.......i.....u..F..cC.I...[....$8...;...4......,....N*.f..P.S..o....u........C.....,.v.v.....t.Xa.m{..4..|....j.xVk..{...@..5..."........V....w.._Y|A\..J...o.....g....y.z.r..$...y.J.sY...+`.|.B];).:...;..q......7.....U)..S.K...K.)PoIj....M...:C....s....T..=..8.R3..X

                                                                                                                                                              C:\Users\user\Desktop\EEEEEEEEEEEEEEEEEEEE (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\ProgramData\D448.tmp
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):199168
                                                                                                                                                              Entropy (8bit):7.997206186701459
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:YFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICo:YlfkaKJ50mylfkaKJ50mylfkaKJ50myl
                                                                                                                                                              MD5:C5926FE8EBDF01BB456FE640C1EB3364
                                                                                                                                                              SHA1:669009FBF8A30AE2D8FE4373FB35098F3D137F4D
                                                                                                                                                              SHA-256:E5A1A8B017A700A350EC9B30D4F86748B08FE5C1DF4FB13C3B7EC5BC99E1E7D7
                                                                                                                                                              SHA-512:372E8720D82B76DFEC41080BE51F60BF19575958526006974D6DE3C7A7B87C0744E756C837AB7AE43005845150BC3B752497193BE7A7CC8C04B47794F9A69DDA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:U.F..5).....C..!...#.T.%0v..wl}.....J/Zs..a?..."....ui<....M...^...%..7.-T...p{..7_x.(].....QX..B.8.*...,'..z0.....l0.+.....Q......."....;.M.RZ.)..v...sMV"C.1A.N=...K.:o[.].....\x......#.G.=....0L.f..."4.,.9.....l.eHb.=#3.S.....(.m....s...Q...{n....H..<..O..E\......<.yE[CTQ..7QlA.j.].KX...5Y......8?\.H....".]..m.]e.@..*...\...LC.S._...Z...>.....U.....}......vs.JYGM....._.rNw..E......Ju.~.O..]Y..dm..O....|..Y..Xa.z.e...6J...i...)...a..............B?9..o.......4.........'..|...&.^~....`.+.t0..J........Bo...s8....K]Yu3b.!b.'.".a.t..J.. /hk.J......J.q...h`SXZ]...(.......U-.9...$.0...(..b..~......v..D.2z....X.w"}..w...v.Y.0..r.. .....3.....".t...T...>....G......._.@..!....R.......i.....u..F..cC.I...[....$8...;...4......,....N*.f..P.S..o....u........C.....,.v.v.....t.Xa.m{..4..|....j.xVk..{...@..5..."........V....w.._Y|A\..J...o.....g....y.z.r..$...y.J.sY...+`.|.B];).:...;..q......7.....U)..S.K...K.)PoIj....M...:C....s....T..=..8.R3..X

                                                                                                                                                              C:\Users\user\Desktop\FFFFFFFFFFFFFFFFFFFF (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\ProgramData\D448.tmp
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):199168
                                                                                                                                                              Entropy (8bit):7.997206186701459
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:YFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICo:YlfkaKJ50mylfkaKJ50mylfkaKJ50myl
                                                                                                                                                              MD5:C5926FE8EBDF01BB456FE640C1EB3364
                                                                                                                                                              SHA1:669009FBF8A30AE2D8FE4373FB35098F3D137F4D
                                                                                                                                                              SHA-256:E5A1A8B017A700A350EC9B30D4F86748B08FE5C1DF4FB13C3B7EC5BC99E1E7D7
                                                                                                                                                              SHA-512:372E8720D82B76DFEC41080BE51F60BF19575958526006974D6DE3C7A7B87C0744E756C837AB7AE43005845150BC3B752497193BE7A7CC8C04B47794F9A69DDA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:U.F..5).....C..!...#.T.%0v..wl}.....J/Zs..a?..."....ui<....M...^...%..7.-T...p{..7_x.(].....QX..B.8.*...,'..z0.....l0.+.....Q......."....;.M.RZ.)..v...sMV"C.1A.N=...K.:o[.].....\x......#.G.=....0L.f..."4.,.9.....l.eHb.=#3.S.....(.m....s...Q...{n....H..<..O..E\......<.yE[CTQ..7QlA.j.].KX...5Y......8?\.H....".]..m.]e.@..*...\...LC.S._...Z...>.....U.....}......vs.JYGM....._.rNw..E......Ju.~.O..]Y..dm..O....|..Y..Xa.z.e...6J...i...)...a..............B?9..o.......4.........'..|...&.^~....`.+.t0..J........Bo...s8....K]Yu3b.!b.'.".a.t..J.. /hk.J......J.q...h`SXZ]...(.......U-.9...$.0...(..b..~......v..D.2z....X.w"}..w...v.Y.0..r.. .....3.....".t...T...>....G......._.@..!....R.......i.....u..F..cC.I...[....$8...;...4......,....N*.f..P.S..o....u........C.....,.v.v.....t.Xa.m{..4..|....j.xVk..{...@..5..."........V....w.._Y|A\..J...o.....g....y.z.r..$...y.J.sY...+`.|.B];).:...;..q......7.....U)..S.K...K.)PoIj....M...:C....s....T..=..8.R3..X

                                                                                                                                                              C:\Users\user\Desktop\GGGGGGGGGGGGGGGGGGGG (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\ProgramData\D448.tmp
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):199168
                                                                                                                                                              Entropy (8bit):7.997206186701459
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:YFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICo:YlfkaKJ50mylfkaKJ50mylfkaKJ50myl
                                                                                                                                                              MD5:C5926FE8EBDF01BB456FE640C1EB3364
                                                                                                                                                              SHA1:669009FBF8A30AE2D8FE4373FB35098F3D137F4D
                                                                                                                                                              SHA-256:E5A1A8B017A700A350EC9B30D4F86748B08FE5C1DF4FB13C3B7EC5BC99E1E7D7
                                                                                                                                                              SHA-512:372E8720D82B76DFEC41080BE51F60BF19575958526006974D6DE3C7A7B87C0744E756C837AB7AE43005845150BC3B752497193BE7A7CC8C04B47794F9A69DDA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:U.F..5).....C..!...#.T.%0v..wl}.....J/Zs..a?..."....ui<....M...^...%..7.-T...p{..7_x.(].....QX..B.8.*...,'..z0.....l0.+.....Q......."....;.M.RZ.)..v...sMV"C.1A.N=...K.:o[.].....\x......#.G.=....0L.f..."4.,.9.....l.eHb.=#3.S.....(.m....s...Q...{n....H..<..O..E\......<.yE[CTQ..7QlA.j.].KX...5Y......8?\.H....".]..m.]e.@..*...\...LC.S._...Z...>.....U.....}......vs.JYGM....._.rNw..E......Ju.~.O..]Y..dm..O....|..Y..Xa.z.e...6J...i...)...a..............B?9..o.......4.........'..|...&.^~....`.+.t0..J........Bo...s8....K]Yu3b.!b.'.".a.t..J.. /hk.J......J.q...h`SXZ]...(.......U-.9...$.0...(..b..~......v..D.2z....X.w"}..w...v.Y.0..r.. .....3.....".t...T...>....G......._.@..!....R.......i.....u..F..cC.I...[....$8...;...4......,....N*.f..P.S..o....u........C.....,.v.v.....t.Xa.m{..4..|....j.xVk..{...@..5..."........V....w.._Y|A\..J...o.....g....y.z.r..$...y.J.sY...+`.|.B];).:...;..q......7.....U)..S.K...K.)PoIj....M...:C....s....T..=..8.R3..X

                                                                                                                                                              C:\Users\user\Desktop\HHHHHHHHHHHHHHHHHHHH (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\ProgramData\D448.tmp
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):199168
                                                                                                                                                              Entropy (8bit):7.997206186701459
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:YFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICo:YlfkaKJ50mylfkaKJ50mylfkaKJ50myl
                                                                                                                                                              MD5:C5926FE8EBDF01BB456FE640C1EB3364
                                                                                                                                                              SHA1:669009FBF8A30AE2D8FE4373FB35098F3D137F4D
                                                                                                                                                              SHA-256:E5A1A8B017A700A350EC9B30D4F86748B08FE5C1DF4FB13C3B7EC5BC99E1E7D7
                                                                                                                                                              SHA-512:372E8720D82B76DFEC41080BE51F60BF19575958526006974D6DE3C7A7B87C0744E756C837AB7AE43005845150BC3B752497193BE7A7CC8C04B47794F9A69DDA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:U.F..5).....C..!...#.T.%0v..wl}.....J/Zs..a?..."....ui<....M...^...%..7.-T...p{..7_x.(].....QX..B.8.*...,'..z0.....l0.+.....Q......."....;.M.RZ.)..v...sMV"C.1A.N=...K.:o[.].....\x......#.G.=....0L.f..."4.,.9.....l.eHb.=#3.S.....(.m....s...Q...{n....H..<..O..E\......<.yE[CTQ..7QlA.j.].KX...5Y......8?\.H....".]..m.]e.@..*...\...LC.S._...Z...>.....U.....}......vs.JYGM....._.rNw..E......Ju.~.O..]Y..dm..O....|..Y..Xa.z.e...6J...i...)...a..............B?9..o.......4.........'..|...&.^~....`.+.t0..J........Bo...s8....K]Yu3b.!b.'.".a.t..J.. /hk.J......J.q...h`SXZ]...(.......U-.9...$.0...(..b..~......v..D.2z....X.w"}..w...v.Y.0..r.. .....3.....".t...T...>....G......._.@..!....R.......i.....u..F..cC.I...[....$8...;...4......,....N*.f..P.S..o....u........C.....,.v.v.....t.Xa.m{..4..|....j.xVk..{...@..5..."........V....w.._Y|A\..J...o.....g....y.z.r..$...y.J.sY...+`.|.B];).:...;..q......7.....U)..S.K...K.)PoIj....M...:C....s....T..=..8.R3..X

                                                                                                                                                              C:\Users\user\Desktop\IIIIIIIIIIIIIIIIIIII (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\ProgramData\D448.tmp
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):199168
                                                                                                                                                              Entropy (8bit):7.997206186701459
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:YFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICo:YlfkaKJ50mylfkaKJ50mylfkaKJ50myl
                                                                                                                                                              MD5:C5926FE8EBDF01BB456FE640C1EB3364
                                                                                                                                                              SHA1:669009FBF8A30AE2D8FE4373FB35098F3D137F4D
                                                                                                                                                              SHA-256:E5A1A8B017A700A350EC9B30D4F86748B08FE5C1DF4FB13C3B7EC5BC99E1E7D7
                                                                                                                                                              SHA-512:372E8720D82B76DFEC41080BE51F60BF19575958526006974D6DE3C7A7B87C0744E756C837AB7AE43005845150BC3B752497193BE7A7CC8C04B47794F9A69DDA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:U.F..5).....C..!...#.T.%0v..wl}.....J/Zs..a?..."....ui<....M...^...%..7.-T...p{..7_x.(].....QX..B.8.*...,'..z0.....l0.+.....Q......."....;.M.RZ.)..v...sMV"C.1A.N=...K.:o[.].....\x......#.G.=....0L.f..."4.,.9.....l.eHb.=#3.S.....(.m....s...Q...{n....H..<..O..E\......<.yE[CTQ..7QlA.j.].KX...5Y......8?\.H....".]..m.]e.@..*...\...LC.S._...Z...>.....U.....}......vs.JYGM....._.rNw..E......Ju.~.O..]Y..dm..O....|..Y..Xa.z.e...6J...i...)...a..............B?9..o.......4.........'..|...&.^~....`.+.t0..J........Bo...s8....K]Yu3b.!b.'.".a.t..J.. /hk.J......J.q...h`SXZ]...(.......U-.9...$.0...(..b..~......v..D.2z....X.w"}..w...v.Y.0..r.. .....3.....".t...T...>....G......._.@..!....R.......i.....u..F..cC.I...[....$8...;...4......,....N*.f..P.S..o....u........C.....,.v.v.....t.Xa.m{..4..|....j.xVk..{...@..5..."........V....w.._Y|A\..J...o.....g....y.z.r..$...y.J.sY...+`.|.B];).:...;..q......7.....U)..S.K...K.)PoIj....M...:C....s....T..=..8.R3..X

                                                                                                                                                              C:\Users\user\Desktop\JJJJJJJJJJJJJJJJJJJJ (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\ProgramData\D448.tmp
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):199168
                                                                                                                                                              Entropy (8bit):7.997206186701459
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:YFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICo:YlfkaKJ50mylfkaKJ50mylfkaKJ50myl
                                                                                                                                                              MD5:C5926FE8EBDF01BB456FE640C1EB3364
                                                                                                                                                              SHA1:669009FBF8A30AE2D8FE4373FB35098F3D137F4D
                                                                                                                                                              SHA-256:E5A1A8B017A700A350EC9B30D4F86748B08FE5C1DF4FB13C3B7EC5BC99E1E7D7
                                                                                                                                                              SHA-512:372E8720D82B76DFEC41080BE51F60BF19575958526006974D6DE3C7A7B87C0744E756C837AB7AE43005845150BC3B752497193BE7A7CC8C04B47794F9A69DDA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:U.F..5).....C..!...#.T.%0v..wl}.....J/Zs..a?..."....ui<....M...^...%..7.-T...p{..7_x.(].....QX..B.8.*...,'..z0.....l0.+.....Q......."....;.M.RZ.)..v...sMV"C.1A.N=...K.:o[.].....\x......#.G.=....0L.f..."4.,.9.....l.eHb.=#3.S.....(.m....s...Q...{n....H..<..O..E\......<.yE[CTQ..7QlA.j.].KX...5Y......8?\.H....".]..m.]e.@..*...\...LC.S._...Z...>.....U.....}......vs.JYGM....._.rNw..E......Ju.~.O..]Y..dm..O....|..Y..Xa.z.e...6J...i...)...a..............B?9..o.......4.........'..|...&.^~....`.+.t0..J........Bo...s8....K]Yu3b.!b.'.".a.t..J.. /hk.J......J.q...h`SXZ]...(.......U-.9...$.0...(..b..~......v..D.2z....X.w"}..w...v.Y.0..r.. .....3.....".t...T...>....G......._.@..!....R.......i.....u..F..cC.I...[....$8...;...4......,....N*.f..P.S..o....u........C.....,.v.v.....t.Xa.m{..4..|....j.xVk..{...@..5..."........V....w.._Y|A\..J...o.....g....y.z.r..$...y.J.sY...+`.|.B];).:...;..q......7.....U)..S.K...K.)PoIj....M...:C....s....T..=..8.R3..X

                                                                                                                                                              C:\Users\user\Desktop\KKKKKKKKKKKKKKKKKKKK (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\ProgramData\D448.tmp
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):199168
                                                                                                                                                              Entropy (8bit):7.997206186701459
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:YFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICo:YlfkaKJ50mylfkaKJ50mylfkaKJ50myl
                                                                                                                                                              MD5:C5926FE8EBDF01BB456FE640C1EB3364
                                                                                                                                                              SHA1:669009FBF8A30AE2D8FE4373FB35098F3D137F4D
                                                                                                                                                              SHA-256:E5A1A8B017A700A350EC9B30D4F86748B08FE5C1DF4FB13C3B7EC5BC99E1E7D7
                                                                                                                                                              SHA-512:372E8720D82B76DFEC41080BE51F60BF19575958526006974D6DE3C7A7B87C0744E756C837AB7AE43005845150BC3B752497193BE7A7CC8C04B47794F9A69DDA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:U.F..5).....C..!...#.T.%0v..wl}.....J/Zs..a?..."....ui<....M...^...%..7.-T...p{..7_x.(].....QX..B.8.*...,'..z0.....l0.+.....Q......."....;.M.RZ.)..v...sMV"C.1A.N=...K.:o[.].....\x......#.G.=....0L.f..."4.,.9.....l.eHb.=#3.S.....(.m....s...Q...{n....H..<..O..E\......<.yE[CTQ..7QlA.j.].KX...5Y......8?\.H....".]..m.]e.@..*...\...LC.S._...Z...>.....U.....}......vs.JYGM....._.rNw..E......Ju.~.O..]Y..dm..O....|..Y..Xa.z.e...6J...i...)...a..............B?9..o.......4.........'..|...&.^~....`.+.t0..J........Bo...s8....K]Yu3b.!b.'.".a.t..J.. /hk.J......J.q...h`SXZ]...(.......U-.9...$.0...(..b..~......v..D.2z....X.w"}..w...v.Y.0..r.. .....3.....".t...T...>....G......._.@..!....R.......i.....u..F..cC.I...[....$8...;...4......,....N*.f..P.S..o....u........C.....,.v.v.....t.Xa.m{..4..|....j.xVk..{...@..5..."........V....w.._Y|A\..J...o.....g....y.z.r..$...y.J.sY...+`.|.B];).:...;..q......7.....U)..S.K...K.)PoIj....M...:C....s....T..=..8.R3..X

                                                                                                                                                              C:\Users\user\Desktop\LLLLLLLLLLLLLLLLLLLL (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\ProgramData\D448.tmp
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):199168
                                                                                                                                                              Entropy (8bit):7.997206186701459
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:YFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICo:YlfkaKJ50mylfkaKJ50mylfkaKJ50myl
                                                                                                                                                              MD5:C5926FE8EBDF01BB456FE640C1EB3364
                                                                                                                                                              SHA1:669009FBF8A30AE2D8FE4373FB35098F3D137F4D
                                                                                                                                                              SHA-256:E5A1A8B017A700A350EC9B30D4F86748B08FE5C1DF4FB13C3B7EC5BC99E1E7D7
                                                                                                                                                              SHA-512:372E8720D82B76DFEC41080BE51F60BF19575958526006974D6DE3C7A7B87C0744E756C837AB7AE43005845150BC3B752497193BE7A7CC8C04B47794F9A69DDA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:U.F..5).....C..!...#.T.%0v..wl}.....J/Zs..a?..."....ui<....M...^...%..7.-T...p{..7_x.(].....QX..B.8.*...,'..z0.....l0.+.....Q......."....;.M.RZ.)..v...sMV"C.1A.N=...K.:o[.].....\x......#.G.=....0L.f..."4.,.9.....l.eHb.=#3.S.....(.m....s...Q...{n....H..<..O..E\......<.yE[CTQ..7QlA.j.].KX...5Y......8?\.H....".]..m.]e.@..*...\...LC.S._...Z...>.....U.....}......vs.JYGM....._.rNw..E......Ju.~.O..]Y..dm..O....|..Y..Xa.z.e...6J...i...)...a..............B?9..o.......4.........'..|...&.^~....`.+.t0..J........Bo...s8....K]Yu3b.!b.'.".a.t..J.. /hk.J......J.q...h`SXZ]...(.......U-.9...$.0...(..b..~......v..D.2z....X.w"}..w...v.Y.0..r.. .....3.....".t...T...>....G......._.@..!....R.......i.....u..F..cC.I...[....$8...;...4......,....N*.f..P.S..o....u........C.....,.v.v.....t.Xa.m{..4..|....j.xVk..{...@..5..."........V....w.._Y|A\..J...o.....g....y.z.r..$...y.J.sY...+`.|.B];).:...;..q......7.....U)..S.K...K.)PoIj....M...:C....s....T..=..8.R3..X

                                                                                                                                                              C:\Users\user\Desktop\MMMMMMMMMMMMMMMMMMMM (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\ProgramData\D448.tmp
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):199168
                                                                                                                                                              Entropy (8bit):7.997206186701459
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:YFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICo:YlfkaKJ50mylfkaKJ50mylfkaKJ50myl
                                                                                                                                                              MD5:C5926FE8EBDF01BB456FE640C1EB3364
                                                                                                                                                              SHA1:669009FBF8A30AE2D8FE4373FB35098F3D137F4D
                                                                                                                                                              SHA-256:E5A1A8B017A700A350EC9B30D4F86748B08FE5C1DF4FB13C3B7EC5BC99E1E7D7
                                                                                                                                                              SHA-512:372E8720D82B76DFEC41080BE51F60BF19575958526006974D6DE3C7A7B87C0744E756C837AB7AE43005845150BC3B752497193BE7A7CC8C04B47794F9A69DDA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:U.F..5).....C..!...#.T.%0v..wl}.....J/Zs..a?..."....ui<....M...^...%..7.-T...p{..7_x.(].....QX..B.8.*...,'..z0.....l0.+.....Q......."....;.M.RZ.)..v...sMV"C.1A.N=...K.:o[.].....\x......#.G.=....0L.f..."4.,.9.....l.eHb.=#3.S.....(.m....s...Q...{n....H..<..O..E\......<.yE[CTQ..7QlA.j.].KX...5Y......8?\.H....".]..m.]e.@..*...\...LC.S._...Z...>.....U.....}......vs.JYGM....._.rNw..E......Ju.~.O..]Y..dm..O....|..Y..Xa.z.e...6J...i...)...a..............B?9..o.......4.........'..|...&.^~....`.+.t0..J........Bo...s8....K]Yu3b.!b.'.".a.t..J.. /hk.J......J.q...h`SXZ]...(.......U-.9...$.0...(..b..~......v..D.2z....X.w"}..w...v.Y.0..r.. .....3.....".t...T...>....G......._.@..!....R.......i.....u..F..cC.I...[....$8...;...4......,....N*.f..P.S..o....u........C.....,.v.v.....t.Xa.m{..4..|....j.xVk..{...@..5..."........V....w.._Y|A\..J...o.....g....y.z.r..$...y.J.sY...+`.|.B];).:...;..q......7.....U)..S.K...K.)PoIj....M...:C....s....T..=..8.R3..X

                                                                                                                                                              C:\Users\user\Desktop\NNNNNNNNNNNNNNNNNNNN (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\ProgramData\D448.tmp
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):199168
                                                                                                                                                              Entropy (8bit):7.997206186701459
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:YFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICo:YlfkaKJ50mylfkaKJ50mylfkaKJ50myl
                                                                                                                                                              MD5:C5926FE8EBDF01BB456FE640C1EB3364
                                                                                                                                                              SHA1:669009FBF8A30AE2D8FE4373FB35098F3D137F4D
                                                                                                                                                              SHA-256:E5A1A8B017A700A350EC9B30D4F86748B08FE5C1DF4FB13C3B7EC5BC99E1E7D7
                                                                                                                                                              SHA-512:372E8720D82B76DFEC41080BE51F60BF19575958526006974D6DE3C7A7B87C0744E756C837AB7AE43005845150BC3B752497193BE7A7CC8C04B47794F9A69DDA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:U.F..5).....C..!...#.T.%0v..wl}.....J/Zs..a?..."....ui<....M...^...%..7.-T...p{..7_x.(].....QX..B.8.*...,'..z0.....l0.+.....Q......."....;.M.RZ.)..v...sMV"C.1A.N=...K.:o[.].....\x......#.G.=....0L.f..."4.,.9.....l.eHb.=#3.S.....(.m....s...Q...{n....H..<..O..E\......<.yE[CTQ..7QlA.j.].KX...5Y......8?\.H....".]..m.]e.@..*...\...LC.S._...Z...>.....U.....}......vs.JYGM....._.rNw..E......Ju.~.O..]Y..dm..O....|..Y..Xa.z.e...6J...i...)...a..............B?9..o.......4.........'..|...&.^~....`.+.t0..J........Bo...s8....K]Yu3b.!b.'.".a.t..J.. /hk.J......J.q...h`SXZ]...(.......U-.9...$.0...(..b..~......v..D.2z....X.w"}..w...v.Y.0..r.. .....3.....".t...T...>....G......._.@..!....R.......i.....u..F..cC.I...[....$8...;...4......,....N*.f..P.S..o....u........C.....,.v.v.....t.Xa.m{..4..|....j.xVk..{...@..5..."........V....w.._Y|A\..J...o.....g....y.z.r..$...y.J.sY...+`.|.B];).:...;..q......7.....U)..S.K...K.)PoIj....M...:C....s....T..=..8.R3..X

                                                                                                                                                              C:\Users\user\Desktop\OOOOOOOOOOOOOOOOOOOO (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\ProgramData\D448.tmp
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):199168
                                                                                                                                                              Entropy (8bit):7.997206186701459
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:YFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICo:YlfkaKJ50mylfkaKJ50mylfkaKJ50myl
                                                                                                                                                              MD5:C5926FE8EBDF01BB456FE640C1EB3364
                                                                                                                                                              SHA1:669009FBF8A30AE2D8FE4373FB35098F3D137F4D
                                                                                                                                                              SHA-256:E5A1A8B017A700A350EC9B30D4F86748B08FE5C1DF4FB13C3B7EC5BC99E1E7D7
                                                                                                                                                              SHA-512:372E8720D82B76DFEC41080BE51F60BF19575958526006974D6DE3C7A7B87C0744E756C837AB7AE43005845150BC3B752497193BE7A7CC8C04B47794F9A69DDA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:U.F..5).....C..!...#.T.%0v..wl}.....J/Zs..a?..."....ui<....M...^...%..7.-T...p{..7_x.(].....QX..B.8.*...,'..z0.....l0.+.....Q......."....;.M.RZ.)..v...sMV"C.1A.N=...K.:o[.].....\x......#.G.=....0L.f..."4.,.9.....l.eHb.=#3.S.....(.m....s...Q...{n....H..<..O..E\......<.yE[CTQ..7QlA.j.].KX...5Y......8?\.H....".]..m.]e.@..*...\...LC.S._...Z...>.....U.....}......vs.JYGM....._.rNw..E......Ju.~.O..]Y..dm..O....|..Y..Xa.z.e...6J...i...)...a..............B?9..o.......4.........'..|...&.^~....`.+.t0..J........Bo...s8....K]Yu3b.!b.'.".a.t..J.. /hk.J......J.q...h`SXZ]...(.......U-.9...$.0...(..b..~......v..D.2z....X.w"}..w...v.Y.0..r.. .....3.....".t...T...>....G......._.@..!....R.......i.....u..F..cC.I...[....$8...;...4......,....N*.f..P.S..o....u........C.....,.v.v.....t.Xa.m{..4..|....j.xVk..{...@..5..."........V....w.._Y|A\..J...o.....g....y.z.r..$...y.J.sY...+`.|.B];).:...;..q......7.....U)..S.K...K.)PoIj....M...:C....s....T..=..8.R3..X

                                                                                                                                                              C:\Users\user\Desktop\PPPPPPPPPPPPPPPPPPPP (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\ProgramData\D448.tmp
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):199168
                                                                                                                                                              Entropy (8bit):7.997206186701459
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:YFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICo:YlfkaKJ50mylfkaKJ50mylfkaKJ50myl
                                                                                                                                                              MD5:C5926FE8EBDF01BB456FE640C1EB3364
                                                                                                                                                              SHA1:669009FBF8A30AE2D8FE4373FB35098F3D137F4D
                                                                                                                                                              SHA-256:E5A1A8B017A700A350EC9B30D4F86748B08FE5C1DF4FB13C3B7EC5BC99E1E7D7
                                                                                                                                                              SHA-512:372E8720D82B76DFEC41080BE51F60BF19575958526006974D6DE3C7A7B87C0744E756C837AB7AE43005845150BC3B752497193BE7A7CC8C04B47794F9A69DDA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:U.F..5).....C..!...#.T.%0v..wl}.....J/Zs..a?..."....ui<....M...^...%..7.-T...p{..7_x.(].....QX..B.8.*...,'..z0.....l0.+.....Q......."....;.M.RZ.)..v...sMV"C.1A.N=...K.:o[.].....\x......#.G.=....0L.f..."4.,.9.....l.eHb.=#3.S.....(.m....s...Q...{n....H..<..O..E\......<.yE[CTQ..7QlA.j.].KX...5Y......8?\.H....".]..m.]e.@..*...\...LC.S._...Z...>.....U.....}......vs.JYGM....._.rNw..E......Ju.~.O..]Y..dm..O....|..Y..Xa.z.e...6J...i...)...a..............B?9..o.......4.........'..|...&.^~....`.+.t0..J........Bo...s8....K]Yu3b.!b.'.".a.t..J.. /hk.J......J.q...h`SXZ]...(.......U-.9...$.0...(..b..~......v..D.2z....X.w"}..w...v.Y.0..r.. .....3.....".t...T...>....G......._.@..!....R.......i.....u..F..cC.I...[....$8...;...4......,....N*.f..P.S..o....u........C.....,.v.v.....t.Xa.m{..4..|....j.xVk..{...@..5..."........V....w.._Y|A\..J...o.....g....y.z.r..$...y.J.sY...+`.|.B];).:...;..q......7.....U)..S.K...K.)PoIj....M...:C....s....T..=..8.R3..X

                                                                                                                                                              C:\Users\user\Desktop\QQQQQQQQQQQQQQQQQQQQ (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\ProgramData\D448.tmp
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):199168
                                                                                                                                                              Entropy (8bit):7.997206186701459
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:YFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICo:YlfkaKJ50mylfkaKJ50mylfkaKJ50myl
                                                                                                                                                              MD5:C5926FE8EBDF01BB456FE640C1EB3364
                                                                                                                                                              SHA1:669009FBF8A30AE2D8FE4373FB35098F3D137F4D
                                                                                                                                                              SHA-256:E5A1A8B017A700A350EC9B30D4F86748B08FE5C1DF4FB13C3B7EC5BC99E1E7D7
                                                                                                                                                              SHA-512:372E8720D82B76DFEC41080BE51F60BF19575958526006974D6DE3C7A7B87C0744E756C837AB7AE43005845150BC3B752497193BE7A7CC8C04B47794F9A69DDA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:U.F..5).....C..!...#.T.%0v..wl}.....J/Zs..a?..."....ui<....M...^...%..7.-T...p{..7_x.(].....QX..B.8.*...,'..z0.....l0.+.....Q......."....;.M.RZ.)..v...sMV"C.1A.N=...K.:o[.].....\x......#.G.=....0L.f..."4.,.9.....l.eHb.=#3.S.....(.m....s...Q...{n....H..<..O..E\......<.yE[CTQ..7QlA.j.].KX...5Y......8?\.H....".]..m.]e.@..*...\...LC.S._...Z...>.....U.....}......vs.JYGM....._.rNw..E......Ju.~.O..]Y..dm..O....|..Y..Xa.z.e...6J...i...)...a..............B?9..o.......4.........'..|...&.^~....`.+.t0..J........Bo...s8....K]Yu3b.!b.'.".a.t..J.. /hk.J......J.q...h`SXZ]...(.......U-.9...$.0...(..b..~......v..D.2z....X.w"}..w...v.Y.0..r.. .....3.....".t...T...>....G......._.@..!....R.......i.....u..F..cC.I...[....$8...;...4......,....N*.f..P.S..o....u........C.....,.v.v.....t.Xa.m{..4..|....j.xVk..{...@..5..."........V....w.._Y|A\..J...o.....g....y.z.r..$...y.J.sY...+`.|.B];).:...;..q......7.....U)..S.K...K.)PoIj....M...:C....s....T..=..8.R3..X

                                                                                                                                                              C:\Users\user\Desktop\RRRRRRRRRRRRRRRRRRRR (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\ProgramData\D448.tmp
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):199168
                                                                                                                                                              Entropy (8bit):7.997206186701459
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:YFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICo:YlfkaKJ50mylfkaKJ50mylfkaKJ50myl
                                                                                                                                                              MD5:C5926FE8EBDF01BB456FE640C1EB3364
                                                                                                                                                              SHA1:669009FBF8A30AE2D8FE4373FB35098F3D137F4D
                                                                                                                                                              SHA-256:E5A1A8B017A700A350EC9B30D4F86748B08FE5C1DF4FB13C3B7EC5BC99E1E7D7
                                                                                                                                                              SHA-512:372E8720D82B76DFEC41080BE51F60BF19575958526006974D6DE3C7A7B87C0744E756C837AB7AE43005845150BC3B752497193BE7A7CC8C04B47794F9A69DDA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:U.F..5).....C..!...#.T.%0v..wl}.....J/Zs..a?..."....ui<....M...^...%..7.-T...p{..7_x.(].....QX..B.8.*...,'..z0.....l0.+.....Q......."....;.M.RZ.)..v...sMV"C.1A.N=...K.:o[.].....\x......#.G.=....0L.f..."4.,.9.....l.eHb.=#3.S.....(.m....s...Q...{n....H..<..O..E\......<.yE[CTQ..7QlA.j.].KX...5Y......8?\.H....".]..m.]e.@..*...\...LC.S._...Z...>.....U.....}......vs.JYGM....._.rNw..E......Ju.~.O..]Y..dm..O....|..Y..Xa.z.e...6J...i...)...a..............B?9..o.......4.........'..|...&.^~....`.+.t0..J........Bo...s8....K]Yu3b.!b.'.".a.t..J.. /hk.J......J.q...h`SXZ]...(.......U-.9...$.0...(..b..~......v..D.2z....X.w"}..w...v.Y.0..r.. .....3.....".t...T...>....G......._.@..!....R.......i.....u..F..cC.I...[....$8...;...4......,....N*.f..P.S..o....u........C.....,.v.v.....t.Xa.m{..4..|....j.xVk..{...@..5..."........V....w.._Y|A\..J...o.....g....y.z.r..$...y.J.sY...+`.|.B];).:...;..q......7.....U)..S.K...K.)PoIj....M...:C....s....T..=..8.R3..X

                                                                                                                                                              C:\Users\user\Desktop\SSSSSSSSSSSSSSSSSSSS (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\ProgramData\D448.tmp
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):199168
                                                                                                                                                              Entropy (8bit):7.997206186701459
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:YFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICo:YlfkaKJ50mylfkaKJ50mylfkaKJ50myl
                                                                                                                                                              MD5:C5926FE8EBDF01BB456FE640C1EB3364
                                                                                                                                                              SHA1:669009FBF8A30AE2D8FE4373FB35098F3D137F4D
                                                                                                                                                              SHA-256:E5A1A8B017A700A350EC9B30D4F86748B08FE5C1DF4FB13C3B7EC5BC99E1E7D7
                                                                                                                                                              SHA-512:372E8720D82B76DFEC41080BE51F60BF19575958526006974D6DE3C7A7B87C0744E756C837AB7AE43005845150BC3B752497193BE7A7CC8C04B47794F9A69DDA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:U.F..5).....C..!...#.T.%0v..wl}.....J/Zs..a?..."....ui<....M...^...%..7.-T...p{..7_x.(].....QX..B.8.*...,'..z0.....l0.+.....Q......."....;.M.RZ.)..v...sMV"C.1A.N=...K.:o[.].....\x......#.G.=....0L.f..."4.,.9.....l.eHb.=#3.S.....(.m....s...Q...{n....H..<..O..E\......<.yE[CTQ..7QlA.j.].KX...5Y......8?\.H....".]..m.]e.@..*...\...LC.S._...Z...>.....U.....}......vs.JYGM....._.rNw..E......Ju.~.O..]Y..dm..O....|..Y..Xa.z.e...6J...i...)...a..............B?9..o.......4.........'..|...&.^~....`.+.t0..J........Bo...s8....K]Yu3b.!b.'.".a.t..J.. /hk.J......J.q...h`SXZ]...(.......U-.9...$.0...(..b..~......v..D.2z....X.w"}..w...v.Y.0..r.. .....3.....".t...T...>....G......._.@..!....R.......i.....u..F..cC.I...[....$8...;...4......,....N*.f..P.S..o....u........C.....,.v.v.....t.Xa.m{..4..|....j.xVk..{...@..5..."........V....w.._Y|A\..J...o.....g....y.z.r..$...y.J.sY...+`.|.B];).:...;..q......7.....U)..S.K...K.)PoIj....M...:C....s....T..=..8.R3..X

                                                                                                                                                              C:\Users\user\Desktop\TTTTTTTTTTTTTTTTTTTT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\ProgramData\D448.tmp
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):199168
                                                                                                                                                              Entropy (8bit):7.997206186701459
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:YFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICo:YlfkaKJ50mylfkaKJ50mylfkaKJ50myl
                                                                                                                                                              MD5:C5926FE8EBDF01BB456FE640C1EB3364
                                                                                                                                                              SHA1:669009FBF8A30AE2D8FE4373FB35098F3D137F4D
                                                                                                                                                              SHA-256:E5A1A8B017A700A350EC9B30D4F86748B08FE5C1DF4FB13C3B7EC5BC99E1E7D7
                                                                                                                                                              SHA-512:372E8720D82B76DFEC41080BE51F60BF19575958526006974D6DE3C7A7B87C0744E756C837AB7AE43005845150BC3B752497193BE7A7CC8C04B47794F9A69DDA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:U.F..5).....C..!...#.T.%0v..wl}.....J/Zs..a?..."....ui<....M...^...%..7.-T...p{..7_x.(].....QX..B.8.*...,'..z0.....l0.+.....Q......."....;.M.RZ.)..v...sMV"C.1A.N=...K.:o[.].....\x......#.G.=....0L.f..."4.,.9.....l.eHb.=#3.S.....(.m....s...Q...{n....H..<..O..E\......<.yE[CTQ..7QlA.j.].KX...5Y......8?\.H....".]..m.]e.@..*...\...LC.S._...Z...>.....U.....}......vs.JYGM....._.rNw..E......Ju.~.O..]Y..dm..O....|..Y..Xa.z.e...6J...i...)...a..............B?9..o.......4.........'..|...&.^~....`.+.t0..J........Bo...s8....K]Yu3b.!b.'.".a.t..J.. /hk.J......J.q...h`SXZ]...(.......U-.9...$.0...(..b..~......v..D.2z....X.w"}..w...v.Y.0..r.. .....3.....".t...T...>....G......._.@..!....R.......i.....u..F..cC.I...[....$8...;...4......,....N*.f..P.S..o....u........C.....,.v.v.....t.Xa.m{..4..|....j.xVk..{...@..5..."........V....w.._Y|A\..J...o.....g....y.z.r..$...y.J.sY...+`.|.B];).:...;..q......7.....U)..S.K...K.)PoIj....M...:C....s....T..=..8.R3..X

                                                                                                                                                              C:\Users\user\Desktop\UUUUUUUUUUUUUUUUUUUU (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\ProgramData\D448.tmp
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):199168
                                                                                                                                                              Entropy (8bit):7.997206186701459
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:YFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICo:YlfkaKJ50mylfkaKJ50mylfkaKJ50myl
                                                                                                                                                              MD5:C5926FE8EBDF01BB456FE640C1EB3364
                                                                                                                                                              SHA1:669009FBF8A30AE2D8FE4373FB35098F3D137F4D
                                                                                                                                                              SHA-256:E5A1A8B017A700A350EC9B30D4F86748B08FE5C1DF4FB13C3B7EC5BC99E1E7D7
                                                                                                                                                              SHA-512:372E8720D82B76DFEC41080BE51F60BF19575958526006974D6DE3C7A7B87C0744E756C837AB7AE43005845150BC3B752497193BE7A7CC8C04B47794F9A69DDA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:U.F..5).....C..!...#.T.%0v..wl}.....J/Zs..a?..."....ui<....M...^...%..7.-T...p{..7_x.(].....QX..B.8.*...,'..z0.....l0.+.....Q......."....;.M.RZ.)..v...sMV"C.1A.N=...K.:o[.].....\x......#.G.=....0L.f..."4.,.9.....l.eHb.=#3.S.....(.m....s...Q...{n....H..<..O..E\......<.yE[CTQ..7QlA.j.].KX...5Y......8?\.H....".]..m.]e.@..*...\...LC.S._...Z...>.....U.....}......vs.JYGM....._.rNw..E......Ju.~.O..]Y..dm..O....|..Y..Xa.z.e...6J...i...)...a..............B?9..o.......4.........'..|...&.^~....`.+.t0..J........Bo...s8....K]Yu3b.!b.'.".a.t..J.. /hk.J......J.q...h`SXZ]...(.......U-.9...$.0...(..b..~......v..D.2z....X.w"}..w...v.Y.0..r.. .....3.....".t...T...>....G......._.@..!....R.......i.....u..F..cC.I...[....$8...;...4......,....N*.f..P.S..o....u........C.....,.v.v.....t.Xa.m{..4..|....j.xVk..{...@..5..."........V....w.._Y|A\..J...o.....g....y.z.r..$...y.J.sY...+`.|.B];).:...;..q......7.....U)..S.K...K.)PoIj....M...:C....s....T..=..8.R3..X

                                                                                                                                                              C:\Users\user\Desktop\VVVVVVVVVVVVVVVVVVVV (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\ProgramData\D448.tmp
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):199168
                                                                                                                                                              Entropy (8bit):7.997206186701459
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:YFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICo:YlfkaKJ50mylfkaKJ50mylfkaKJ50myl
                                                                                                                                                              MD5:C5926FE8EBDF01BB456FE640C1EB3364
                                                                                                                                                              SHA1:669009FBF8A30AE2D8FE4373FB35098F3D137F4D
                                                                                                                                                              SHA-256:E5A1A8B017A700A350EC9B30D4F86748B08FE5C1DF4FB13C3B7EC5BC99E1E7D7
                                                                                                                                                              SHA-512:372E8720D82B76DFEC41080BE51F60BF19575958526006974D6DE3C7A7B87C0744E756C837AB7AE43005845150BC3B752497193BE7A7CC8C04B47794F9A69DDA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:U.F..5).....C..!...#.T.%0v..wl}.....J/Zs..a?..."....ui<....M...^...%..7.-T...p{..7_x.(].....QX..B.8.*...,'..z0.....l0.+.....Q......."....;.M.RZ.)..v...sMV"C.1A.N=...K.:o[.].....\x......#.G.=....0L.f..."4.,.9.....l.eHb.=#3.S.....(.m....s...Q...{n....H..<..O..E\......<.yE[CTQ..7QlA.j.].KX...5Y......8?\.H....".]..m.]e.@..*...\...LC.S._...Z...>.....U.....}......vs.JYGM....._.rNw..E......Ju.~.O..]Y..dm..O....|..Y..Xa.z.e...6J...i...)...a..............B?9..o.......4.........'..|...&.^~....`.+.t0..J........Bo...s8....K]Yu3b.!b.'.".a.t..J.. /hk.J......J.q...h`SXZ]...(.......U-.9...$.0...(..b..~......v..D.2z....X.w"}..w...v.Y.0..r.. .....3.....".t...T...>....G......._.@..!....R.......i.....u..F..cC.I...[....$8...;...4......,....N*.f..P.S..o....u........C.....,.v.v.....t.Xa.m{..4..|....j.xVk..{...@..5..."........V....w.._Y|A\..J...o.....g....y.z.r..$...y.J.sY...+`.|.B];).:...;..q......7.....U)..S.K...K.)PoIj....M...:C....s....T..=..8.R3..X

                                                                                                                                                              C:\Users\user\Desktop\WWWWWWWWWWWWWWWWWWWW (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\ProgramData\D448.tmp
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):199168
                                                                                                                                                              Entropy (8bit):7.997206186701459
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:YFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICo:YlfkaKJ50mylfkaKJ50mylfkaKJ50myl
                                                                                                                                                              MD5:C5926FE8EBDF01BB456FE640C1EB3364
                                                                                                                                                              SHA1:669009FBF8A30AE2D8FE4373FB35098F3D137F4D
                                                                                                                                                              SHA-256:E5A1A8B017A700A350EC9B30D4F86748B08FE5C1DF4FB13C3B7EC5BC99E1E7D7
                                                                                                                                                              SHA-512:372E8720D82B76DFEC41080BE51F60BF19575958526006974D6DE3C7A7B87C0744E756C837AB7AE43005845150BC3B752497193BE7A7CC8C04B47794F9A69DDA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:U.F..5).....C..!...#.T.%0v..wl}.....J/Zs..a?..."....ui<....M...^...%..7.-T...p{..7_x.(].....QX..B.8.*...,'..z0.....l0.+.....Q......."....;.M.RZ.)..v...sMV"C.1A.N=...K.:o[.].....\x......#.G.=....0L.f..."4.,.9.....l.eHb.=#3.S.....(.m....s...Q...{n....H..<..O..E\......<.yE[CTQ..7QlA.j.].KX...5Y......8?\.H....".]..m.]e.@..*...\...LC.S._...Z...>.....U.....}......vs.JYGM....._.rNw..E......Ju.~.O..]Y..dm..O....|..Y..Xa.z.e...6J...i...)...a..............B?9..o.......4.........'..|...&.^~....`.+.t0..J........Bo...s8....K]Yu3b.!b.'.".a.t..J.. /hk.J......J.q...h`SXZ]...(.......U-.9...$.0...(..b..~......v..D.2z....X.w"}..w...v.Y.0..r.. .....3.....".t...T...>....G......._.@..!....R.......i.....u..F..cC.I...[....$8...;...4......,....N*.f..P.S..o....u........C.....,.v.v.....t.Xa.m{..4..|....j.xVk..{...@..5..."........V....w.._Y|A\..J...o.....g....y.z.r..$...y.J.sY...+`.|.B];).:...;..q......7.....U)..S.K...K.)PoIj....M...:C....s....T..=..8.R3..X

                                                                                                                                                              C:\Users\user\Desktop\XXXXXXXXXXXXXXXXXXXX (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\ProgramData\D448.tmp
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):199168
                                                                                                                                                              Entropy (8bit):7.997206186701459
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:YFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICo:YlfkaKJ50mylfkaKJ50mylfkaKJ50myl
                                                                                                                                                              MD5:C5926FE8EBDF01BB456FE640C1EB3364
                                                                                                                                                              SHA1:669009FBF8A30AE2D8FE4373FB35098F3D137F4D
                                                                                                                                                              SHA-256:E5A1A8B017A700A350EC9B30D4F86748B08FE5C1DF4FB13C3B7EC5BC99E1E7D7
                                                                                                                                                              SHA-512:372E8720D82B76DFEC41080BE51F60BF19575958526006974D6DE3C7A7B87C0744E756C837AB7AE43005845150BC3B752497193BE7A7CC8C04B47794F9A69DDA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:U.F..5).....C..!...#.T.%0v..wl}.....J/Zs..a?..."....ui<....M...^...%..7.-T...p{..7_x.(].....QX..B.8.*...,'..z0.....l0.+.....Q......."....;.M.RZ.)..v...sMV"C.1A.N=...K.:o[.].....\x......#.G.=....0L.f..."4.,.9.....l.eHb.=#3.S.....(.m....s...Q...{n....H..<..O..E\......<.yE[CTQ..7QlA.j.].KX...5Y......8?\.H....".]..m.]e.@..*...\...LC.S._...Z...>.....U.....}......vs.JYGM....._.rNw..E......Ju.~.O..]Y..dm..O....|..Y..Xa.z.e...6J...i...)...a..............B?9..o.......4.........'..|...&.^~....`.+.t0..J........Bo...s8....K]Yu3b.!b.'.".a.t..J.. /hk.J......J.q...h`SXZ]...(.......U-.9...$.0...(..b..~......v..D.2z....X.w"}..w...v.Y.0..r.. .....3.....".t...T...>....G......._.@..!....R.......i.....u..F..cC.I...[....$8...;...4......,....N*.f..P.S..o....u........C.....,.v.v.....t.Xa.m{..4..|....j.xVk..{...@..5..."........V....w.._Y|A\..J...o.....g....y.z.r..$...y.J.sY...+`.|.B];).:...;..q......7.....U)..S.K...K.)PoIj....M...:C....s....T..=..8.R3..X

                                                                                                                                                              C:\Users\user\Desktop\YYYYYYYYYYYYYYYYYYYY (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\ProgramData\D448.tmp
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):199168
                                                                                                                                                              Entropy (8bit):7.997206186701459
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:YFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICo:YlfkaKJ50mylfkaKJ50mylfkaKJ50myl
                                                                                                                                                              MD5:C5926FE8EBDF01BB456FE640C1EB3364
                                                                                                                                                              SHA1:669009FBF8A30AE2D8FE4373FB35098F3D137F4D
                                                                                                                                                              SHA-256:E5A1A8B017A700A350EC9B30D4F86748B08FE5C1DF4FB13C3B7EC5BC99E1E7D7
                                                                                                                                                              SHA-512:372E8720D82B76DFEC41080BE51F60BF19575958526006974D6DE3C7A7B87C0744E756C837AB7AE43005845150BC3B752497193BE7A7CC8C04B47794F9A69DDA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:U.F..5).....C..!...#.T.%0v..wl}.....J/Zs..a?..."....ui<....M...^...%..7.-T...p{..7_x.(].....QX..B.8.*...,'..z0.....l0.+.....Q......."....;.M.RZ.)..v...sMV"C.1A.N=...K.:o[.].....\x......#.G.=....0L.f..."4.,.9.....l.eHb.=#3.S.....(.m....s...Q...{n....H..<..O..E\......<.yE[CTQ..7QlA.j.].KX...5Y......8?\.H....".]..m.]e.@..*...\...LC.S._...Z...>.....U.....}......vs.JYGM....._.rNw..E......Ju.~.O..]Y..dm..O....|..Y..Xa.z.e...6J...i...)...a..............B?9..o.......4.........'..|...&.^~....`.+.t0..J........Bo...s8....K]Yu3b.!b.'.".a.t..J.. /hk.J......J.q...h`SXZ]...(.......U-.9...$.0...(..b..~......v..D.2z....X.w"}..w...v.Y.0..r.. .....3.....".t...T...>....G......._.@..!....R.......i.....u..F..cC.I...[....$8...;...4......,....N*.f..P.S..o....u........C.....,.v.v.....t.Xa.m{..4..|....j.xVk..{...@..5..."........V....w.._Y|A\..J...o.....g....y.z.r..$...y.J.sY...+`.|.B];).:...;..q......7.....U)..S.K...K.)PoIj....M...:C....s....T..=..8.R3..X

                                                                                                                                                              C:\Users\user\Desktop\ZZZZZZZZZZZZZZZZZZZZ (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\ProgramData\D448.tmp
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):199168
                                                                                                                                                              Entropy (8bit):7.997206186701459
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:YFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICz3JDlAhD1pasZFnNTZknQJKICo:YlfkaKJ50mylfkaKJ50mylfkaKJ50myl
                                                                                                                                                              MD5:C5926FE8EBDF01BB456FE640C1EB3364
                                                                                                                                                              SHA1:669009FBF8A30AE2D8FE4373FB35098F3D137F4D
                                                                                                                                                              SHA-256:E5A1A8B017A700A350EC9B30D4F86748B08FE5C1DF4FB13C3B7EC5BC99E1E7D7
                                                                                                                                                              SHA-512:372E8720D82B76DFEC41080BE51F60BF19575958526006974D6DE3C7A7B87C0744E756C837AB7AE43005845150BC3B752497193BE7A7CC8C04B47794F9A69DDA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:U.F..5).....C..!...#.T.%0v..wl}.....J/Zs..a?..."....ui<....M...^...%..7.-T...p{..7_x.(].....QX..B.8.*...,'..z0.....l0.+.....Q......."....;.M.RZ.)..v...sMV"C.1A.N=...K.:o[.].....\x......#.G.=....0L.f..."4.,.9.....l.eHb.=#3.S.....(.m....s...Q...{n....H..<..O..E\......<.yE[CTQ..7QlA.j.].KX...5Y......8?\.H....".]..m.]e.@..*...\...LC.S._...Z...>.....U.....}......vs.JYGM....._.rNw..E......Ju.~.O..]Y..dm..O....|..Y..Xa.z.e...6J...i...)...a..............B?9..o.......4.........'..|...&.^~....`.+.t0..J........Bo...s8....K]Yu3b.!b.'.".a.t..J.. /hk.J......J.q...h`SXZ]...(.......U-.9...$.0...(..b..~......v..D.2z....X.w"}..w...v.Y.0..r.. .....3.....".t...T...>....G......._.@..!....R.......i.....u..F..cC.I...[....$8...;...4......,....N*.f..P.S..o....u........C.....,.v.v.....t.Xa.m{..4..|....j.xVk..{...@..5..."........V....w.._Y|A\..J...o.....g....y.z.r..$...y.J.sY...+`.|.B];).:...;..q......7.....U)..S.K...K.)PoIj....M...:C....s....T..=..8.R3..X

                                                                                                                                                              C:\Users\user\Documents\AIXACVYBSB.docx.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1273
                                                                                                                                                              Entropy (8bit):7.8426841889530685
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:bj/7g1EI+1mYsO6NW1JGWFfkmj5mVDJzogKSFWhethJozUQdY+:fb5vsz2YIm7EzSFWhPUQa+
                                                                                                                                                              MD5:7F1492BA8AF468C6EF1B7A2F3363F70D
                                                                                                                                                              SHA1:540C442F5945086CEF4D8A15045F64E1FB09B021
                                                                                                                                                              SHA-256:BD449087C1FD87E2AA5FDB80C531D7494F4418D87C6B7770667651E2ED892166
                                                                                                                                                              SHA-512:08D80C2130CF89FE995B8E5E776392C2C6DC0FC4BEDDF2481D1CEA2F6EEF60A4DC310C1077CFD6330CEB2D7FA9500BC176EB51908DD5C9EEC132922884762D3F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....d...H.Z...&@bF..[..U%.~.<G>i.9......7~h...c<.1...}...H&M=...."_X:^]V....X..-+.}..9..T....;.osB..d..[..X(....G....L[....jt...f.p.... >..VE...H.,..7...B.G.....y5z...R_.........1/......_4.>O.....n\....?\8..M.WV.E.W.s.".F...v%MG...^.MFW.A.#.*c.!.....{.J_.9^.9K5=..=&....8..(......Nc...n.>3.?..LR>....E.!..}s.v.6..z....?j....}-..H.X...8....h..t......_.D..(...I.qh).PQ._.. )....>EG.->........epRt....2.........6.s.g..E.@5.8u...eu.,.]..R....9...cC.n.E....7..T..Z.t.i..Ek..&..........9.=...|.T....F............C.|8}..........JC.....x..h8.h!i~...dB...0s..k...?f#._......w.0.A........Ne.....S.j.4.3..............v..f..&.}D.w9ev....8....1.&...X)....dN...CcDXot..zJ..L5.....7{.(..P.R3...3.(.Oe.WF\..."...A.....b..4 ..(.x.............j..w.../.....u.~..ZH#44......w9F.Z..R"%............bG....,Z..A.:.(.uLH....8.....Cqh....M..%......3.4bY.7x6.b....D....l9u...........A>....F.9.Dl.7..._.e...\!LI._...w$.......F....8..5..........'...sM.|#'~.=..KD..+P

                                                                                                                                                              C:\Users\user\Documents\BPMLNOBVSB.mp3.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1271
                                                                                                                                                              Entropy (8bit):7.852288372740462
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:FPf8GyZazRxdWvOnXJGKHW1FwDwsLjquF5kVW9rMLGkSg41krO+:FPfReazRxrn4KQFPsLmWKLq71krO+
                                                                                                                                                              MD5:51D4744793910776188DF2483470CE90
                                                                                                                                                              SHA1:A14F3AB7D0A98D6A514F06DE5313756217A9C051
                                                                                                                                                              SHA-256:70F7E874161E5A5B5C9AEF75FEADADF636D86D7DF05440B17E7815CFA9AA30EC
                                                                                                                                                              SHA-512:9DFB41DCDAF06F4881EB3FB9C6B15A2846E9B4329F07D28CBF959A826645A8C8F01BD3F65BF788A4023A9B8B564BB11ACBCDA4410DE1A5473BEEE4707A2B14DE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:;.5@2..8^.4...NL.N.....Q....l...tZsl..o`?.hn+j..D..5X.x..JGrHQ..f..H.?.z. .;..[...h..A.....7.F.%....=[..Q..uy..e.k.p..T.L.'6L."..j.G...:.....P...'..I.$a.I...|.8...u./....1.&.-#&Eg....5.5.' Y).]...n,q..@.j..T.....;......].4......j.......e.x..O...M.y..;m.jc..9{D.]Zv..$."../8(j.......Q...b.Q.6..!....Q..%....{.z+..........yvs.w.gbg'.[.v.m..Z...NQO......}....X;...o;..5{H#w...j-.b..|...E.K.....].....G.y.........C2....H!gfB.]?..A..6.....3?.C^..Bn..'.k...>....Dh..+.B;..)..Mk...-......Ca........y..2.........g...`.Z..I~..QXQE.P.Kq..TL....../G...e.)...h.).V..:..sa|p+...Gw.p....SX..Hb.:..{.h0{fI....8..KC.....A..O.l(O.N..|.....b.O.x+...*...].H...K..A.$.Cg......K.0...%...S...H.K.Ic..H.}...y..`a."#..........P..Dap.K.~%60P..M.fJ.|...Tl,.h.zV.,.m.;...L...AU.........}j..p._.E*.......L..@...:`M...3.8,..s.1S..A.[.f/.d.-:....Q3...7.<.....UR..F..;.......H.......<...k...?.<g.....&?$..%.x....b7.l..bz.[.S..;2..Y.K...+.M..\.N...Qk..l^.z.Q*..3@A..)...W..Pc

                                                                                                                                                              C:\Users\user\Documents\DTBZGIOOSO.docx.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1272
                                                                                                                                                              Entropy (8bit):7.878821204194427
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:kKGol28oEg2MztqI8ooq2S/YRfGYjLfVxRxjnRKs+:5Gol7o3AInQRfGsBxNR+
                                                                                                                                                              MD5:236C5C81CCCCE0F1CB70D85664B56647
                                                                                                                                                              SHA1:66E9C65629F8737238BC9124CC05E8BE23C63B4B
                                                                                                                                                              SHA-256:DA43C1C5578B7935CB4A993FD51CA194F2A30EDA693102CDB4D31C49CBC84EE8
                                                                                                                                                              SHA-512:55D248806B7E2B4BF73A55DD6F3D22ACED63728478325E3D2CF44E7C733E14A54867B9B86C134CEF5AAADD5E6013D35F3A2F1D319ABEBBAE753423B1EAA08AA6
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:E...O......1i$%..T>E,.2.h.......L..w....'s.r...E..\.U.4...E5u...K'..Hkt..X.N...g.../O8.1.(`.o.sHK...%...K.."a.1...iU.rfS..n3.<....0.-.._?`h.7@l..Yu|.>j/LL....Z...e.......qi.~.o.~f.O._3..0B.."s......p.X.}*QvS..m.iw.....s...`.ecS.m;@z...9.P^..."..@.U...m9VM...R>._..k.v.$...wW.**..,...A..t=E........mQi.5u......fJG.V..6$.'}:67.w.....x.f..H.....0..<......3_.S...z7..;.|..Q.N@qz.U.P...-.I.A.ETp..$.YB/ m.v .=AG....W.....`?..K.eEq...]...F...xK.........fZ.[........v...j#G.Q&-4+.>,][.......j.(...H.%...;..2@..\9$x.\.^.T+v5..3uz.g..vVt...F..|.,mH|.......{g.Jve..O....)H]`=VI.u..:..+.4C.......5....H.....MkyY.......>.9.....j...e.U..f...~...D].5...w1..$.X..h..xQ]G...R3.<e.2.G..iF....Q..cB.S.8)....#.r.w..?N......."ex....!..&q..&S6...}."j...X.c..8?......5......g.(......].?...I:0.....H.........Z.7....q..C]..Z...[..c.4.l:k.S....b..b.........-Z.q^.;.TO......./..G4VQ.....0...].P../.t...n..06m?XeP.2.H..[V.}....9...Dt_....d....(..ux7]c....(...n.}:.J...0b...".@......s..

                                                                                                                                                              C:\Users\user\Documents\DTBZGIOOSO.xlsx.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1271
                                                                                                                                                              Entropy (8bit):7.8424922532668635
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:LrdRg+E3UfBB9EIMytGIOQuG7+/2rG7ln/FYcv+:XTE3UZT3zkpn/5v+
                                                                                                                                                              MD5:E7A134ACF7922A88B7C018E0D56A506B
                                                                                                                                                              SHA1:2BD76AF4097CA63EEBA63396808599268EF02DF9
                                                                                                                                                              SHA-256:61EB2B2610772B5778093D362E2C714D898E447AA5D46775C31DEA9B8F3B41DB
                                                                                                                                                              SHA-512:4E9EA3ECB1E952174347F3034B0110ED81C3FFB22456881D6B73B37BC706439373AC7B8F5940C0F9E7D24F179B8E429490DDA0454733762EA48B585480D8BB10
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.Tf..).2.;....o..R.4.....h8..$e........#..^...e.6.....y.D..4gg2.q.4..U.....=.b.v.4}...w)Z..{.[6V4..P....&G...|..\D-Z7....c......MG.B8d..e\..[...P...v9....[3.Ir...`...B.x.'Z.....G....^...|\...x....%.?x...0AZ.7....eU|....OqC...oN...LU.L.I....@n.n....."..0.....,...P]../6t..I?8.f./.|!...J..A...f....5BS..bKp.2.m5J../..ZN_...U*.lFUkR..U....kWdLB..3...U.....#...N..)2.=..d...\........R..Ia...U.Kp.]..2..x.[.L.YIU.<-D.K......B....2v.&lTp....5.p.h....L.a..C...f...9..y.._..iUb.dN.W.8?..=0.10i.E..8.......#X[..T\.[5t9..UD.P...n./....>.L...{#I...T..*y...e-..{o.*#...>.c...=0........y.p....JRf.!%...."9...&0.......S...].dx.lL]...2]..@7U......D..a^..c.O.O._D]b..V.^>W.p.......@..:\._.y..5.....g.{......W.;k...$...;.x... .......-..VT.t0.O...._5.D.v..:.3-.^..Ub....l.....ges.......+.[{P..MS'<.5e..S.-z\H..aF.VN8T...$..]..Bg^....N.....v......5...,...fw+..$.9.\.d!...>N..J.c.....G/.....L6....w......;...u.=..m.lX..D.z^k3.S.abu..kw]9.6......`..R8.U....'...aL.....o...

                                                                                                                                                              C:\Users\user\Documents\DVWHKMNFNN.pdf.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1271
                                                                                                                                                              Entropy (8bit):7.844594652331883
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:61NsIxboNaGB2s+FJnl0wFGUhBPcktY3dOeDbixOoE/7mC7t8QkMGTP+HkubS+:8NjboHB2xJnWwsM63DMOoE/SUnxHku++
                                                                                                                                                              MD5:FD7A2040FBB12F04EAC29F25C4A57B8C
                                                                                                                                                              SHA1:5AC3B44428D10C940271B6770E920994C719379A
                                                                                                                                                              SHA-256:17BFA6F1081B06BDAFA941AE2E489684AC66989317DC2F4C825A0CDA13A7D57B
                                                                                                                                                              SHA-512:C4A46E711A23380265E5AE640E6E7588142A0C621E7E4C94558148992DFA8E661E8EC4C488AA7E72C7BF73D4DD11DBA9B9B8F4420967B70CA9AF0F156B4ADBE4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....J.....}e..^...h..z......%.<.Ti...QU..nw].i7.&...@.z.C..I).........N.)...^f~u4d3..Q.KAh.j!....X.R....F..6g'c.ai...?HxF....}..w.u...HYW.pj.....Y..<\...\PV&.........7..j_.U...@......M....=...6.{...2..W..q....<C5.G+......8..4....C..9.b.mE."E.+d.!>"....0...j........wmhDW..'.<@.R3...V.z....|..,.c.............A..`j.f..`.H>.gw...@......RP..c../6...=.,?.oU.....V.q..h.pdaS..|..."*./m$.UQ...`.xI!.L{..];...ij;.X...1...O.?..k..jy}~..P..!.7I#..&kr..^...b.J.H.{.+.#S....Z..........v...Qz.Y.[.........o..p.&.!.t....w. Q.....[..P.k.%w..tQ..Gg.....Xb.o.DCg..,v.....<.......?|.m.....)....cI.J..z..d..y..yx...7...l..c...b.sm.'...1..f.yC...Y=...:W..i......n?.w..N.|{._..j.E.in......;......v./il5...Qa.....y..9..m.LW~.[u...K..........3.#$..7.....fx.#...+..q.Ek.@..4T.6X.....O......+B....q.,".$..g.<.X8-..Q.kpZb=,...W..-C.-....fm.ag..b`{t.x.08%._x:.m(.....l..tXO....).?.P.....,..Q.......G..P..\. ..(.m...wS.|...R.....VQ ._`.3.........v.R-...z6{..5-........X7w(3....;I.y

                                                                                                                                                              C:\Users\user\Documents\FENIVHOIKN.png.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1270
                                                                                                                                                              Entropy (8bit):7.84820327568794
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:f3ovR52ilDVv64jsGjTegUKS+abKHlY2iKYSypTxQCh+:f3of1Bvkbg5S+EKHlYdz9QCh+
                                                                                                                                                              MD5:C78C9310C728E1F5D0D4F678A5037063
                                                                                                                                                              SHA1:491A6CB914F086A3446CD2317EB3F86A84487AF2
                                                                                                                                                              SHA-256:A4B9D7B5BD5D652FE0D5BE2421C8E33CDC1DEF1F00A927BE72E1B4F067CB1136
                                                                                                                                                              SHA-512:E41CAAD7E55B4F54A40948DA6E42D1C4439F25496321B921C548C5A56FD94CD4C0EBCE114B07DE1DB1F48FBC3900FEF2EFDC9845A15F78A84ADFB30D10513CBE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:q|......3@...'.....L.6.."E..i{.........|.e)2..FZX.V..2...m...j....'.y..R.....fV.m~......V...!.*C.O6.9..n.Sa..W.......jz........Sv.rE6..c.I......M.y......[.AR....70l..=..C.s...l)...q..&F.-.d(|.]...0`Dl..pnc~.~j.....d........^.u.!'.,..!A...{#..\_J.L..9..gA(!.P.7.>...P).L...<}..X..T.....(.wv........q...0.c........5..5...R...y.|._...2^i. .....(=|&V4/..o.dA.9..\.jh..7.|O.(..R..._8...)wC..{.6...$H..FT......v..-?....#..V F..#.+..r1.%qL..o<.xn..IwN5.... .V.:]1?].G.r}Pg..{.......`.q.>....<..V..{.Y..J6...:.r.h.J.O.Xt.D1..y..TO..I.`-.Q.Y{{..;..6T\>.:.]c...%|...?.V..]L.EB).,I...[.q....I..e...(.Mfv./...K.^...8#..C...j.o.@..XY..uR.D.$>..%`t......#LoRl..&...k(..J..>.}e.....i...j..1.-N.'..iA.S.....i.J!EA8...T...Uw.2..V. .... 3x........a~..0....X..`Ku$x..HO...S..^3..E.>.5"...U..efOW.......X.\....h.0.K..{...(q...o.c.....88;.|.Sg..Oc.0..d.'%.Q.<.J~..a1ty...5...>)}o`.p3U?)][...:N....!Q..(...U.91.sT.[..O......-94.t...i..0...18.sB.."...?.u..v.P........h?6[..7..^.P

                                                                                                                                                              C:\Users\user\Documents\HTAGVDFUIE.jpg.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1273
                                                                                                                                                              Entropy (8bit):7.839023873176986
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:ylRKXdOOjwwtmEmI4SaNKBM/noYA3WTk5AIe6abQC+:sZbEn4SaNKBMfoYAy74C+
                                                                                                                                                              MD5:BB7F5EE22AFCC8B514C7D79B749539C2
                                                                                                                                                              SHA1:AC4771D54AA8E42250A0E45A072819527A58A959
                                                                                                                                                              SHA-256:A027E953FDABA260E36636851A15F4D0BEC7D050A0C5746313B727DD2C05D56C
                                                                                                                                                              SHA-512:8D88AFD05AA55D6500A4363D66A5078A28612EB75984AD7CF360589A419EDDAAD00D61B245D7229113F8B1896B8A8AE923DB1BD1AB51C0AFAA9851713F94C0E4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.W...F..n.\....dhw......@@3..'n...z.3..X[...R'o..@..I.]F.....s.+$C.).....~.<Pz.Op.C..R....t.|Q17.....,.D.e#S..O....r....../T.[..._..q.6w#&y1..FJB.....1MjOz.13.x)cs.......O......D..5f..qn.....v.".y..=Bx..~....$.....H.....f-...hu....}f...A....zt.}.....>..a.,.?i.@1@.(.....}.*..tj&q.2N.~.Y=`s.....:..&>.......;.>Z=.....w....|.hf..wx....o.of.P1^.i.T.:...a..m.56.!..>.T.Or.ge.X&u.'..5....!..-w..B..b.60.O...m9..pp.%.......e)...Rr...I..GY..|..,.n.;..,....d.O.....S.n.,.O{.^.m.$....q.M....nG.U|././..D..N.'.........,!ag:.4.}..~...#..b...@.).Y^_&<.*.....Hk.......^i&...`.Y.J`...,.m..q....z.....L+O&.U...~(.....'mHyJ..P......j}qkux\WqF...6,Ak......B.*.D.....*...@.j.=....e1......6"..c.((?...h...J...)..._P.~....Ht.... @N...W....{....o5.\.+t.....}...`!..a.v.d.p.Q#.Z1..r..r*1.L..eM$......h.#APA..L......\....v.p..!7..PL...C.j.)..)'......^S...$..A.hL..?.N......".aFy.z..4.]D..`v..O.....".a.. ................OM..\..V}L..x0.K...;....L......^.F."B....'..........

                                                                                                                                                              C:\Users\user\Documents\HTAGVDFUIE.xlsx.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1274
                                                                                                                                                              Entropy (8bit):7.847145598708025
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:3tasjrnbLQWG5mj/MSWx9RRu5AsbDdTU/88AL6wsvc9VW5D2n+:wsnbLQWG0MS2xMAcBTUE8AVsE7W52n+
                                                                                                                                                              MD5:2926C93855540378E8C18B03BD132C61
                                                                                                                                                              SHA1:8A3A87157D913DA4BE38D0E4F24F07B4B05BA733
                                                                                                                                                              SHA-256:AA8D8C0919AFF22AD197553F730D4571A9A859F6CE6830F2501ECCCC5C601410
                                                                                                                                                              SHA-512:EDB55BFA81A2965CD842AB504AC87D7608075464E464C77D5837EFF6305E5FA37A3E0B032658D561E8562D97BF822FE6F71626F502B32124532C8B459C328BD3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.j.z..."l....7+"*.R..Vj.|...>....t..._u'...mT.0......P.0C..%.....=.r....L...r7..(.j.Y..GvD...>.t....v..(xufqX..J.[v_s...V..]yv..%.....m.n..W..b...q..3z.......L^......b@..2.t..2Fx..5...+h....7.0....7....G<...A..WB..jD.u...$....[...4,.@..y....0.......:E.,..$a.A....P...NN.F.z...T........Zk......"...?...I..gk.z.....O-.%....t...8x....c9R...p.>.y..).@...../..<,..`>.~%.L.<..q...D.w../*...n...../.....0q....v.!...Hg...s..}..>.n..\J3...y.i......*Y.....m..{.._.P......S......."..).!\.o..<...Cs...........k.....Q;..w..0..R.\y.>..sv%wK...b.._zD...4..(#?m..]...K..Bm....,i....Q.F....?b....3...*.9.p..E[U..G..6..Xg....Hp.y.V..>.....9.....JX.,..w......s4.DS.+PvD...-...rM7|n..Z.R....s}.b...VG.u.e......D.m.....'.....f>.n....s2}.z.a.....eN.O.>..L..>........Gt.....tS....AZm......6....D.{R..........{...}..}z.K....|..b.../.Y.k.........!.+..)I.[,A.sEC......(p..!...*..a..14.Z.T...T..I\.C7>.=....w'X.qm.a/.L{Z\WN.KV...f>jM>...E...A..KF..7..[.~.....fA...3........U....A{

                                                                                                                                                              C:\Users\user\Documents\JSDNGYCOWY.png.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1272
                                                                                                                                                              Entropy (8bit):7.84823618277439
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:o48gUjaThztgLwXLX3JaPWbhSwQK3QZao2lP43nN1TjdCmd+:oLaFZMAr3gPWekVlA3N1Txd+
                                                                                                                                                              MD5:4A763E6C682458750CD19ACB551BC8EC
                                                                                                                                                              SHA1:F18C6E789515D25EC127F680B68D11631F92D668
                                                                                                                                                              SHA-256:0AC448C7CB03722F62E49979DEFFD9BFB90D3ABA444964379035CE5666AD744B
                                                                                                                                                              SHA-512:0A03617DBA0AD065ADE67219E31ABFD0B30FBA51960A49AB497E81442D85556644B4E433549BFA564200FBB387EF7C1CF86525107FAF7BA14DCF577359FEDB98
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:Q..)...@.pU.......].Zq....z.......Y...Z..R.....I.z..%.B.w...4..Pwm.s0<F...1....Q...T..p./.c.EI R.../Y......@A...L.....Z..r}...@....M(...c..]6.daN`..Y..*q.9...deF.."G,ee..}...eT.6....8......I.......b:.:....... r.8..Xw..{8..0.,..+1...S...S}.G.. .....!~.YAtek.o....L.....{<?lr..i.c..P.".q...C./..yT..R.bs...zcX.c..!T..K...}z.g..B...;=.}[.s.p.k......>.>\..?.:..6s....KI.:Y..\....Cnq@....IK....v.H.S..T..........B....Q..$...X+....H.o..J"..6V.9'.wGW5.K.m...R..x.6.73...W..a....1.\....'..U`U.}....4.u....-f....Z.v.#4.W.U,Y.bX._....T.mo.dc*s.B[b.r...S..L+%.rNV.'....q..B.....-..p?....tP...........<..n:Z....c.......P..<...c.A....O.5$S......3.Z.T...4L..Q..Gm._r..v..<.."...J.i.3.C!N..9....q.p....VIA.......@.%.....|R\rN..!................wz.;.J./.S...._Z..n.M....)6Y.&.....r..b..'..^.u.r..\z.../..y_2Lj)J(..rXc .....#c...u.......F6{.;..;...v.{ .`/....|RK.ZyC..!@..7....o.W..:.I...j...>.c$.../..=.F]i...@.....4.,....0..<...E-~..7....J.......*...|..=..$............32<Q

                                                                                                                                                              C:\Users\user\Documents\LTKMYBSEYZ.png.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1272
                                                                                                                                                              Entropy (8bit):7.879780310354724
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:IeUidhSII/nWzqBgLoHHIYSbPQXNsMdVRAvPla4aXsC8ftHaW++:IeZOneqBGoIDPQ9/nRAvPlE8Co++
                                                                                                                                                              MD5:9A4B3BB45DD89192F455CD77CAEE7518
                                                                                                                                                              SHA1:3F520688C83F337DEE1B4984ACFF8660CBEA2790
                                                                                                                                                              SHA-256:0D2FDC7C5C102E6BC1F086E42FFDEA2B1EF545425E747522FF7853B71AEF5D5B
                                                                                                                                                              SHA-512:7BC9FAC7665ECC3D23BC51CB1C2ACED2B7B3806B4071B3CCEA66758EC6928F27687C2E5E0609522D134ACD7B2F41B6940569E3CD5A06369497D1C43ABB4E75DD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..P.T$.U..K..J[..f.5..S.......gE......O....Az....v.tl-.U..4.E...1...z......N.....ZU....1..m...@..W.LK..;.es9.2yZ..@..|.P.Ml}S7.eauqWx.........T...'.7.]A..@..,.Uj$.^... e.....).?...H..~...i....k.[sPp$wYa...TjIv'W...j..`.zZ...7.f....0...l.]V$.L6.,..D.|.]..n$E..1Rt#..vo0....A.w>2..%...i.h.0zk..9.^.......9u.PT....y..cL..}.q... .t.. SN.....k..~...o..1..... 'A/....%.^.b.X.WZ.~Y...x0T[K._S.~.~6^..Vn.S...."..e......H......\...IW{W..3n:p..j.M..7O.AScqH..u9".+......m....(..........H.....-.y~#>v.D*...".......~....`.*..R.1p1..#+/h....W...]_..y4.WB.zC..\..DTN...~..w..F.{5.iv<:....8.=.....g...pY......vc..#A..}...T.e4..}3Kbl5..X...uN1Z.{b..a&..!2\rk.,..._B.JH....Jq.Y$..I.....G..DK.pL.g/x^!.....{.Q.%....q....i...).q..b....V..,..9..z..v/.[d...-l-......*)-^`..0.y......z!...<.o..w...CS.W.X..E....`p.<..........E.x....}...5..U.+...?.@0a...+.J.......RU%..#.p.'...N+\[:.v@%.H..&....G..bN........6...}8.G.Jz)*.b.g.Wb.qB.|s.j..c&.a%......@.....t...8...$.1..pQ..P.Q~.

                                                                                                                                                              C:\Users\user\Documents\ONBQCLYSPU.docx.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1275
                                                                                                                                                              Entropy (8bit):7.854016126791
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:wCBNftGSiOzLkKl33e3oIyPL30XmSJ0IjCHYrig/yOy1z4BKec+:wiVZiOHzV3e39QL3T00pc/54zB+
                                                                                                                                                              MD5:5B8CC41E09D08912C34870D191710917
                                                                                                                                                              SHA1:E220BA44DDBFDD632F36F9F10D6D24000B5C943C
                                                                                                                                                              SHA-256:9BA3E516B52B80DB8A9DA84355E049A0058019C8455B7295D9C84F73F28F5CC6
                                                                                                                                                              SHA-512:318C017FCFA18DFDC051B5E96061FEB1F41E7CE68118908083041868FEFAF923B956B291BDA6AD42930F93575D3AC233C67E8CCBDE58127E50CE966E67502044
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.Y.l..|.[yE...MB..0.......i.|.t.E..}...[p.KFN..1vV5.Z2|.4.....b...j.G7&.?{.-.Lu....^.m..KD.hY..S..Y8.w...~... X.X..?..z..f&....U..._C.c....k ..=.Tk..w7|..[..}B..{R.vo..."7fM....n`.Zo..V..20....z.x..<..7.*Y..c.87@?d.b...&S...o]{.N...9F..8&E}[..R0.s.D.R.a.W.?......4.=.mi?.m....j.N..."......+........2..bY=..~..C.j<.~(.=./.3O9L1..:Z.#...*...q...H..#.q0=.@..V...i..*7^.z...A.@[......%&e....T.g...aj....Z.....3..4-..?.........oe\.....&...+.....M....1..a'.u.d.?.N..<5..R..k...u..~!...Ls0..X........=...G.1>...a...........J..:.~.{u..\o:[US.R.....5b..`.".LA.m...H.t.C.J[..(6.....n../.h........?...?....d....o..;@.7...2....Oj!..._.V..~.m.....2...4.\.Z.U}..[.....b..Y.....L...r..D.M....}1X.;j47.p8"%G.Pn..f......qh..j...=.Y*..i!P....)..n.k<}!.,...}....S....M0...5..uA.t.5.z.M..P...$.5D[..'..09>.kx'....H).O..\K:o_`*.;.*........J=w..,:-5.8.|..N...m.......~)...MpH..)x......;@.../p.h_.%..(H}.gyw.......O..`.{k.G..o.0.e.u.......k..4 .f........O..\iqCX.|..+SN...[*...h.4

                                                                                                                                                              C:\Users\user\Documents\ONBQCLYSPU.jpg.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1273
                                                                                                                                                              Entropy (8bit):7.822366361913233
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:xoy35IaSJrNeBo2T3WOextP6ed2cry0c/fdc13WXuyikeU+:qaMpeefOEF6t+2/laguOeU+
                                                                                                                                                              MD5:A9A7F7B2364579484E049C97E8F8D6C0
                                                                                                                                                              SHA1:BB0E22B77278BE60422E3A7AEDD62E2043C2A8FC
                                                                                                                                                              SHA-256:BF4587D420F649C20E7588848370264E710BF21828C0939DE4EC99E4968C8FB7
                                                                                                                                                              SHA-512:8C9F4AEE5CC28BDB068DCB851CAF208EF8075B1B94B70330AA13A94CDBDCBD86D9DF435610D75FB31B21D1D1FB1313D4C66407D84B9BC5C4B7307C2B6A3CEF0A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..f...lf..u...-..bqv.+.lP...#.&X.k.kx0@WJ.Mn x.y.../a.s....2.=)...[..........I.TY..e5...h/|.r...k._!^2m......lY...7...{)....-.W{.G.VUuz.-._..F[.b.b#=.1/`.`.`b.....u.H..=.0..0.M/...<..68....l...........I..........dX?l<l ...l:.)y!..^.."..Z9..#..Mi.,.`......Lw..N...=..~.....9.ndJG...A.$..o..2....dd.....'-..o..VF'Z..q....{h.J..7.l$.n.....W.?C2...g\..x,k.8.0.Ms[.3(.U..sd.....u^..W...$a<..I.t.6..P...)..a..O.|..B% .Mt...*.7j^~e.....J....$..+..S...B.+$.6x...Btt.U.gS6$.j.B!...S0li=.....K.....f;kx.a.._.6..=O.@h...=......,.HS......f..o.2......p/I*7...q..V...M"EZ...OE..............p ..P..9.Q.%.....8.~...DQ.H@:......7.$._i{.E%..q^.6..a...........A..+\.8@.`t`>...r5.]k..H.).JF0........x.(...f.D...N.....#...........F.)@.H.-.kv=.I.#..M...........r.n.C.ND....w..&..?WO...t....q..;..`.}.Bq..5)_{q........N1.+._...W..E..J..Ul.9....<t..3../..q.*{wb'].<......"..i.....%{..q\...X,.~...NO.&...qZ...w.&...r...D.#....;....*(.Ro.....O..1...U..#-`..C.....*.w...

                                                                                                                                                              C:\Users\user\Documents\ONBQCLYSPU.xlsx.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1274
                                                                                                                                                              Entropy (8bit):7.843125975938761
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:JG3YTz487JhyKn3gXwbFikkBLYTE7vGx5IJR/W+Gkfeqt8e6yebBIsUS+:pVJoK3NM1BLvGfIJR1GAV6fb6E+
                                                                                                                                                              MD5:3112A3DE00F28ECEDE374AE3E34B1ACD
                                                                                                                                                              SHA1:431E99FA694BB56912CEC96A57E42FD543F99E71
                                                                                                                                                              SHA-256:26B6A7789C7CD3EB9D732EFC970AC9784393ADBE60F679EB511699257EEDEB4B
                                                                                                                                                              SHA-512:85EAF286F0322E5AB911ACB48DC9CFF09D3F907EBDF89825CB9A89473B41514B3FA6671AB28E4B424852E7FDF22EF8762CE56FD6A0A6F220F28B5DDC7B58C742
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:i#L.G... ...2.Dq...-.?..4....,.:......Y..].%.p..v.a..(.hT^..K.8<..u_W'......*...a.{..Y[K..:..-.$g...?.......y....K.9ck.jW...*.....f.om@7..w.J.U.\mn..m.e@.........6...@hr..>...."..+.f....>\...&..q...J.,SL........kI.J..Km....U.......v.H..m..Hm...V......eh..c.k..{..b........t.%.^j7...68....cI....(.....~C.J)v../.0...k7`...].I..Z.w..?_..^q.|W..^...t.....'...H.....(x.c..d........K8.?+..pV.Ty..?..d.j.I....>.Ns..o.....L.X.~..i.....$...C.db...:....3@...Jb....%....H.~...@df.........a.u.v....w.. N......o.^..k.]..D.......B.(W.....+.Y....M.......Z.O..JM...4........Tz.9m.f.c...6.......b ...>\.....|..D^i.R,#..l...5....Z...q.Z.|k:.X.w.......m.....xZ.V.&@....,.....,..u..G.bi.q.U..l...'.e1.<km..=e.G?:..{Fv.L.)..T8..-q......'.Z.,...._..8.S....&.d...]....._.B....t]gc.Sh....\...c........?....\..L...[..%.\.!..I....G+.....jH....R.,.c.E.K....q.|.q...I6...+;!C .u...%~....PEJ.RZ....{..$....S.V.....`2..X......CY?J.....e.*.t.y.%..E)G#3.bb..>...G......5.O....7.V..

                                                                                                                                                              C:\Users\user\Documents\UMMBDNEQBN.mp3.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1269
                                                                                                                                                              Entropy (8bit):7.854002981488089
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:NtDxeeY4dCKq+t7oJrV6plItC3Fo46SPck4ModfjVZVPIb+:xeeTClpttC3e4jn6jVZo+
                                                                                                                                                              MD5:6704A68098925FD77E33D7CCB652D129
                                                                                                                                                              SHA1:E1A6CDB2C369FCAB10DB3A8164C6B1BC3A1A6456
                                                                                                                                                              SHA-256:AD3F394ED06EB6532B772D94EBF5725D4AB2863974ED265839AFB156B3FA3A8A
                                                                                                                                                              SHA-512:E3094BB3D5205312CE884F6906989AE8F1DA3B57F8B8D6EB93ACFE832E718EC09407FAB894635FD104FA83292A68F193FED68D681F6D7653F4D148C5BC3447F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..}i(...U7s....*zw....F.6._s5..i..?^..P*.J}1.s.SU..2..!.....q.....%.>C.........3f....._....E...yQ.K.aTz^.U.j......O$.....~......0...+.g+!y....d....o...`..U3=c..Y......94...3.I.......T.A...f...L,S.U...4...\n.d..>%b.Q...=bd.w.3...........jw=.Q.m....*.u...Z..Q...q.Ku.0V...Jv4~Y....:K._8.fM...Jg.....=..<B..*@.$.U......S1.......Uzu......k...S..s.a..KoP....Y..X#.u.w*....T+x....?.&..=.. ...%g.....`..b..f03........AU.C..|...D..I...S..k...~.e.'....~.X.....c.`..x.G1.Hv(.q._.......J..8J.T.....-i~.[.N.(:0[.X.....T.o..'.W...@o.......x6..M"...y.........z....Q{.t.............B.Y.......z3..P.GfTS9h..=......I..&~..Q..h.])M....|.4}[.+;N&1...h.....e.N...2..G..p.....DP.%....(.=..1K.}.k...I...W[.\...:@.8F..L.Q....p..?g.M...mT.B..y.....|..*.4.h..X.V...ud.).8..VL.....G....;..f!..&.I[..FC.s.p7Y1......Rf.i....._........D.....~..k...5q..I.v2.5.[.......w#..1.b.%..j.i.9......)e.b.H.....-... .....>.....{.ru.8.{.|.'o..}...c(i.oT.<...I>f..L.%.a...\.l....kZ.f..

                                                                                                                                                              C:\Users\user\Documents\UMMBDNEQBN.pdf.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1269
                                                                                                                                                              Entropy (8bit):7.850444369055871
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:gP+LD25GWV5lYk574HIlqOI0fJYcldhDQHpWHZKPbBjBxJZrF+:KMa5G45Ck57KSqOIoXd7HZKPnRrF+
                                                                                                                                                              MD5:B8CCD30B4E627DCA470D3FDA4D238E34
                                                                                                                                                              SHA1:15E493A40241F0B1FF25638DFEB2710BDF9D18B4
                                                                                                                                                              SHA-256:9740E124E0F6BCF4541E53DF86AB49F4A30F7A372D1DB96F6C586283958EAE25
                                                                                                                                                              SHA-512:77C33975CD070899E879ACED6D260273C23547000C0431A121102F0036133FF3E8DA71F0F990FFB574CF047058EA5B7B970860879123F778FB290AD60973ECFD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..j.~.~).....b...%|..}...\k|J.l..'AX.V..\...Wk.RY.$. ....H....i...}.{/-w....0..}..Hc.............J0=.XiFxS..UmL../..T.?E..^.bL.4b|..WO..,d.../}........QZ_..[?.:..n/.D..L'..({.. ..e....,..oG{..5.1S....B._..~+..l....m.U.......H.P1(;6...&77."....z..K.M.\.....5C."..C...^...co.b..TE...R....)..m...P...*,~<-.&.`.k}sGb......R...u.z.>J..n. P!.?..q.z...`bz.c..W..Q#We.h!.|....w}:.p..9..A...;v>h...A:.....D.......U...f..%6......e..ih.?*0|w'.\O.h.t..Tw.O....*.".FRF8&.2./G.P..!oZ.....b+..O....\...#...t;.@.&.U...C......./N...M:.......+..c.!.5.)g?y.2P.jrO.8..4A.;-.....`.!k.....I....s..{M.......F{.4..b.x.w....j..1.......s...?...N.:l.hn...?dg..C..P3fC..>N\.O.....\....U.#..RO.UPe!.*.......5...Z.]....,3KBV.|%b.....7).s.?..=.ZM.7;..X.Q^%.....f..Z..|Lc.1......a.>.K...........xE.....J.!... |.*d.IP*88......g..5......u.q..].T...\|)..,.\q.3..7.M8>..e.#..>....R..<.......h.#R`-#D..77y.../e..;..D..kE*".D....2n.x..,3FC./.....3.c......w......+..l/.E.,..?E.'..#.^^./;...D@L.yh.

                                                                                                                                                              C:\Users\user\Documents\UMMBDNEQBN.xlsx.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1270
                                                                                                                                                              Entropy (8bit):7.840838900671094
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:IKN3Y0W+gJubrHEL+v6Tsh8jEVCLbKOXtHLJm7csVk5NAsWJK+:rdDGSvqrXCUtHLJm7ciAZ+
                                                                                                                                                              MD5:13AC03C27F0023D50919CFF01AF84AE2
                                                                                                                                                              SHA1:26E8685A3CB4494CE6C7F0E51358950D4E8A8F47
                                                                                                                                                              SHA-256:25163EC56A1E7FA6BB5F7A3BF3772E8137DE1F639210CC1BBFE54971FFA7C25B
                                                                                                                                                              SHA-512:2E6D9AB10F02A4D437DAD358D1B3204F60DC00CE17CD01CE042B19E829DC765606C35F84F31F6946D7073BBAE376A82BBB29CA593EA123166A2A9DD7CF69A4D1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2.Le..~....;5...&.....LO._7....a...S.8.9'...N.i_be.`..,.L.'...y...v%o......op.!..H 2._rx...1....t..D.R........A....f|.}.)...g._........9....Q_f..p..=M.*...bb.Q.q..I.?%.".5}...C..!..@U..gH...c@......@<......3..rxJ....2d..i:NE}.H.#......-.u.d.....".v.x.Y.....H.#X.[....g..!6.0............@............./.....X..M._X..1..a.?..o78.68.L}.*.......J.w..Z.....S=U..?..S#.P....B.G...sf.@9..rT,.szcK.}..s.q.v2>..Q..H....^>...-A..!...c.I..t.=..u......a.-QT...u9z..hC.a3j.._m.W#<.d..H..Q.o..G.G...%W~v..........,sz<.YB...|...E...........|9.....!o.Ik...{5`...k...X..q.I....9... @.D.z..d.C.]b.<1._.<n.....tz4.Qw\I.h...._..aF.I.R.;Jt..d...O..12.......o.{8..6..z|B.u...#.KbCU'....Fr.#}4.h7.+.eT.n..>..........7.f.......am..Bh..V.|G..${:8.a..2V..q...."^..%=..W.M.GbB..?...X..a.Y=.o....w...].Y...q|..J.`..@D..|3........h..FA....O....o..YM..z....Xt..F.3bp......r..e..|.13......o..q.0..R...6.....b....q...J+c.L}..{..X..?....Cd..M...`..@@1HB....w...(.^.V....W9..KZ.%.

                                                                                                                                                              C:\Users\user\Documents\VAMYDFPUND.mp3.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1272
                                                                                                                                                              Entropy (8bit):7.845402452392454
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:5K7ZE4E2JK8N/rPNeEk5AwMDHCm/2MS6MOwVGCPS57xN0gUtJ+:2vK0rP9k5AwmHCmNbIP2agUn+
                                                                                                                                                              MD5:E974CBE190257BCE4A205050C9699FE8
                                                                                                                                                              SHA1:FE9EF3FB94D986ED42923B15ADD8E12B5A450F84
                                                                                                                                                              SHA-256:AD21C52040FD0E13207A76DA944C9866D6E54DB8D72A3266EEE2CD3E8B90D67F
                                                                                                                                                              SHA-512:2433A269FA7FB40435028E4A5294B0518E38FDC1EB71C55BFCFFDA804233A30734254D14C35EE9C622FB6CC79E66E5CA0D69745C057D0D1C72237DB9301FBC36
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:=....u.G...x....D....../.....M.u.)"lrm8[...O.-..7Llj......Ec.h..=8..E...J4.yp?...k...l.LD.5s.......}-5.&....HZ.eO@.[.1}=.dp.p../..YV9.I..9...4^U.[6.. .......=..Y.........l......R0...B.Z..?...3.i.B....4?.t.. ...Gx.Tt"..+.5...DZ.]..RL...r5d..%....GG..3/Fw....oV..c...]Tlm......tw.ag..Z..........T.....8Fh..1_k.. ...D...x..*.....2...h..r.qy`....D)/.V...2.....K.7|..>....3z....ON...83O.49..:......"q...R.'3.......'&..s!P../f.v.I....)R..%\..eub7)5'..Q...L.gmE.....Xv.8...1.|.4.....d...%V?|mU.Wk'C....M[....XwL..o.7.W.z........L..L.c"..[fB)..T.D(..Yn...6..S-.....B...+..(.....Q.bTe.R.Q..rr..........,..p.u".|.Ry.L<.r...%...h........."t.^|&zR....w....Z.@.s0\;o[S.U........].|6.\P.:....:d.O..ch....s../...uD.G~+....q.7.....6Zjj.(o.}........8...Z..c..J.@......3..'f....-41.H..J_.......Q.v....(Z..:.s...&....bB.b...2.Eje.{....+.~q..e..E.=u.9.R..1.:Q.M.A>7U.K].2K.9Ey...{.........d....q..C.7.}....Y8.j........].Vf..P.d+..H$..+.Ztk..1...Uk......h..".r@. .,[o

                                                                                                                                                              C:\Users\user\Documents\VLZDGUKUTZ.png.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1270
                                                                                                                                                              Entropy (8bit):7.845332327577113
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:sHe8/DYgi3tF980o7AJpRj9I4ifq2ON3n3xicOOXDJkwUodG+:h8/DYgatr8T7AnTIrfSB5VnUo8+
                                                                                                                                                              MD5:1EEFCAC3DFA6291AE16EA27F07ACA4BE
                                                                                                                                                              SHA1:E2F904B7E28B18BA26F8DE72C4985B457D348E4D
                                                                                                                                                              SHA-256:525CAF46FEEB8EB9FD26230E9FB1CC78FD1EA25BD1221AD01195685618DD8DE8
                                                                                                                                                              SHA-512:03F41AE562E671B3C9D94F17933B6C707C773F0AC75633973F432012700BB6550397D48B1C11E4E180D82F850FBA034F684D467D40CDD0382530770BBD6D1563
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:}.)...].5|g..A...jm....ixB..<$....P..`.....V.t.*Eu....)...:.. .Bo...B.......I7..}....Be.......S<.J......<ZF...$..>c..../f..]L.{.A..p.R.d;.(M6e@..w..j78..Fx.F{...t...=.k.........PH.....U...7..!..i..@..Y...6.&..S.. ..D.;r.....".r....L.!9.NT.e.(.b....T....T0....n..N..1.w.....:}..|.g....4.MWD.3.[.^i.r.+.?...v....."}U.......zQ.RK<.r.....#..e.......l.)...)..,&{m.........,]...p.C.f.k..Q{A......LK..H..Z=..V.<Ig.GM..._cUmDh?...>....M%pWB .....P'8l&GT.@..W......8..K....Vv.<.%R......)I...;X...!$#&.=.c'o....&..w@..(.IF]"q.4J...N>...L.?.........". %..".`.....( ....b.:....R..3.........A$.f(^q@.~%..5......j..X.!..V_..z5C2...."..E.K"....Vr....g..D...K&8.o.eh.vn.]2. .Jlnc.8a7y./.T.n.-%V.U~*..o.,;.Pn...5...H';7.<..O.".y.lR..n.+.S.!`9.f*. .....O[.b.p;......W...'..m...m..`....;.t.... *vQ.g.."._.......KT.u?2y4xd.0G..U.).1..._..u."..........D....M..f...L...W+h(~..?.Q....VB..M.)......$.u+`i..,x........y..t..G.{aG....[.8.Kk.._.o...t.f.|j...Tnu 6........

                                                                                                                                                              C:\Users\user\Documents\WUTJSCBCFX.jpg.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1272
                                                                                                                                                              Entropy (8bit):7.852099017990303
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:BU5mor5pIRSr0RHmtgEUTctJGqHVaOAraf1kZUh03akUkF1HMClwjHD0u++:Cnr5pIor0R2gLoSsSraNIUe3akf1sClu
                                                                                                                                                              MD5:AFBEC86FE89287FCEBB38F321A5E1607
                                                                                                                                                              SHA1:B788E4D5DD74A2FEC19C6602229AA432A6C8AA01
                                                                                                                                                              SHA-256:21A282C4996EB243DDECF4760D6491589190821CA7E7DB2BE9403942F02F4F30
                                                                                                                                                              SHA-512:4175EC57AA59040B7752F9A030CE3150E90045D34782C4C64D5A59AAB6B8EB87524F60F31A55DA905BAF908CBA630CA5F3F593AD49B76F72F1D3A1112230343C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:P..$..3.\]FI..F..........h.....)<..Glk...(d.c...@\...=../."..x,$.zHq.^..3~..]8W...YE.q8|.a.dZ..{'x..6T.C.s.....c..#..z...4.H..d3..v.E}...L6).$>.k.Kb..x..'...l..R.;...T\xRa.1.....Z......!@g^...+..r..B........(.!s..#U:...h...{,3.._..H..H.).......M.._.......9.yze.8.l.>[.{.P...RX+.hx...t.X.!..V..T....w..!.......;s...=.>....L..c..1.rr...XVG....g...T6.....~.G....0..U.M....w.1..&Q.>..9.AMC.).#.4..{..?W#WJ$.k.2.....P.F....[w.\...<.<..l<.X....7._..?u6..(.y.]+=..WF.^..s.Q...L.=13..~.#i.a3......J...A.=.>..|....sT...).$....k(...\..E....n..P.......<..#..W.<....'..^..q..-.X..GV.g....B..._.y''X.7*.pR.%..{ ....$<!+..7hW.......f..#......e...Z"aki.uf.c...{pY.O.8.~..1.9..c.L..+.{.d..zKQ..".z....n.w.X.......e7...}y!.X.N..o:.n......*.F.....a..-.%.....k.u...F.4..t..2......5<.........#.....Al}v......]............c.F.....dW.hH....9..~`...^.....9...0c..+.?...j6.|V....^...D!l.I,.[@$?.8....`.[w]...e..<w.E...6x..n...'....>..f ./Hw...+9....w.rZ.w4......._4j

                                                                                                                                                              C:\Users\user\Documents\WUTJSCBCFX.mp3.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1272
                                                                                                                                                              Entropy (8bit):7.846784721563603
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:Jx7D/qBKKYOipZ4Lgv8mjJelOXGTvw3ZLrlEYJYdN8cNfwOhCqzoXj2u+:bzqBDvrmjJelOXKvwJd2ZNfZhE+
                                                                                                                                                              MD5:AA94C6864482E167890C20C7A49FFD42
                                                                                                                                                              SHA1:B158DDC617C575D5EEE4401E7615227D0A07BD85
                                                                                                                                                              SHA-256:8F208256A09A43DDBF14AF840098B7365B0DF468BA6386AFFE3CD9C21429B6AA
                                                                                                                                                              SHA-512:6B06657D807EF762E3CB032EDD5CEF4A350D270679C712C0AB2736C7B23B2F2097AC4E3F0C3F218ECFF7C75BD90FE4C39BB0451028E8B27AE47F6B3D0FFD8003
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......lu.........;R.L...Q.W...7..ms.$y)....e.....].".J.D....VJ...e....2...Y..I.k.Zp...T..|...@..S.J..J.:j;j...Fd....u=M^@.F.j.>.H.g.?......Vsb...W.......<LcW..8l.T...p3.....O|..#.e....69K..5Hl.D.....u..!..0.....SY.8..Ggx.&.ac..+..GRV........p.bF5}cA.0..U...W....&....D......6$:....H.d... ...9...E.*.fs|..y.....sL..h1..5!......~.:......h..f.>.4......6...9....y....-)....:.+QX....g..,..se.K.@.{.>..J.-.'s.Vj.+\..J..... ..n.1.6.~].)..'.qf...9-.. .Q..V.P.jBB..9...R?..k..!..-.owyV.I.....+....h....0%.Bm#18..../s......\..3*`B..V.;}$^"9....7.!.dg..~..2.&..N........?.lS.^C.7;f*.rX.........9.J..W..L(F."...4...F:}.lM||f...g..S^.fn.S.Ve~.....{.y}X...D......=.'..I...Mg....Zw%...Hq.x..Iv@L....\a........k.T.hVz.9....@.w.&~fr[...'..1J..g..f+G.F.|..I......[ZU.!........N;h.S..z..Z.}F..l....P..p.j...<..^]D.L._.0.. v..<|.V.....Z.R...........my......../.nW...f..bg.;S...].t....%.(.Ry0.....+..L......j.U.7...#@O...O6...In.... U.X.{I[.*`.H..._.QrN.JX.2..U:..yra.;K!.g.<..

                                                                                                                                                              C:\Users\user\Documents\WUTJSCBCFX.pdf.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1272
                                                                                                                                                              Entropy (8bit):7.850041617759495
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:XyzSq2y/CH+5+cPNn753XhMQ4ukhMLsikE/MrIkrnzKB7+:XCS05pXyQ4vTikEUrIUzo7+
                                                                                                                                                              MD5:E6DC891879D5A792B65652CB2676CA1C
                                                                                                                                                              SHA1:7A7B4AA83C4A7134538EF8893E57F0242DCF2FB1
                                                                                                                                                              SHA-256:6AFC21C3BB3C13EC6DDE893F632316B52A26739B0D12BC50B591BCD0DD93CFB3
                                                                                                                                                              SHA-512:504E12880043A9196C094D91125FFEB49F9FF915FF430335280BA1E2D3988CE23B6B1F42AF69C9327A46088912A2D99A57B352716B92E1E737171CFD2DFC7183
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.1I8`.Vj..}:{...8..F..<"...h.#"..V..4.Nz......_.$.=.....P^...JuNY.....s!k..2gL.....r...3.S.).cu)p.,...|e&....Y........D..Q."wx8....pMm.W..b.....d.....j...s...P...<.U.s.w.&..R..^..............W....$<.....1o0|t.....",.......P.8..p...Hx...i.u.".?....`..dA.m..w.[..'..s....~..?f....L.5.L....T....8l|.=......#.z7Z.At.48.=...n......~.T}...".O...*K4....P.m..#.m|......ga..:.ZG....T..j.+R(....\.X...Z..:.p..(.......j*HUY..Y.a..<.2..N...{..}C,.q.....z.A..>x.x...L..3.D.j..../.;.C}g.,.y..........9.6.@..../.....fS;f$.....-....E.l.:.o..U.\....~wa8<i....bw.<..PB....@k9..4K...4.S.J...=7..1|wPd. ._._...ms...e.J.g<h:.f.j..^..=....2J|...It.B$....../q{......sK*&.6azn...|".s..X2..9.za.d.Q.....v.{.J\....d.n.X**.j..n.tFX]a......2.EP..8.....w....mf..2-..)..yGrT6?.y..\....;Mn|;......?.F......2.WB..PE.s..\..|.s..m.....|.sz....Q.i....I..h..)....K.d...E`C.;@.:..?..x1..T..........DO....p..7...5...j.V;..b.t.j..g!...I.P.nN.......r.x..:zlG...$Y g24n.O.5..:J..m....

                                                                                                                                                              C:\Users\user\Documents\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\Downloads\AIXACVYBSB.docx.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1273
                                                                                                                                                              Entropy (8bit):7.8298149414923435
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:R7o96lv9p5tZ5fvwFD+1AA5JkdhRJmztesUODDUGJ/rQW+jt7J9EuU+:RU6llTv5AFD+eA5JkdvJmBesUOP7/cT5
                                                                                                                                                              MD5:BEBE23EA58539BED48332299AA4674A1
                                                                                                                                                              SHA1:AF620371C6A4DED2C8FE375C034ACBAA57571A71
                                                                                                                                                              SHA-256:F09D6E3F2790E4802F69C6978C6C3CBF3CD9BFF55BD59E64F034F2714A4BA797
                                                                                                                                                              SHA-512:134B4F878BF81F8706EC9277FA305C7C97CCC76AFE79DA15DE35F5381BF2B13FCFEF4677D585B51ECA6B6EE008E82227E1CBBCE1CFA6BBE53DC6C2DFED30D42B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:>. .....sd.T}P`?....:.m....F..M..03?.4..._z.....07.U&....M..J.r.l......:B.$MdR...E.DlfzG....U.[....?...S.HBXp.q%.8...6.1..}.6...&}.._.hfHbg@d?.L1.m.)..4.\ob...~u;.g.......yt....9{...S..Q<.1.."8<...........U.ld...oR.:..a.XR....).4^.'.!l<..%WS.......$.qGx-.A....r.9.q.N...C.>....b.3..Y..EE,+D..X.9..1.-.b..?.J.........9..E..hS....7...n.q.....ke/..<N.c..nf...{g.E )M.e.O....jts...G.........#...(.h.!y.Oe...m.(|.V.T.mV...h...nY'dH6...c..2..V...|.U......,|.`./..Z.5.V.l.^7.......e..I.9...v...pK.....8...Y..p...h....H....)..z<+...jT.KN..>...A...Y.}.U+....`..q...A.s''.Y..F..bI.SP$.%\...E..Gp-F..o9.|...3....Hv.|........G...%..;.r4sg.....G..z.y....d}..%<........~...+..bk.......9.......;...:.}..[...7.u....R ......Y0...e.S..q..k.&.6m...I..*|3L.....d.+........4fV....|C1...V..[ =......$...#.<.V.f.egA.-.t...P.Y...q...N{.}2........2.VW.Es..z....W..Ra...P..`...n.j.DAK.W.7.l.....t...P..&..r..+.d..z.K...nv...xv ..o.....Y}.D..e69..,...c.......4...6{..r.d

                                                                                                                                                              C:\Users\user\Downloads\BPMLNOBVSB.mp3.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1271
                                                                                                                                                              Entropy (8bit):7.842170067498923
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:95yhBA3BQFppYIt+btDlMvKmeOM1CFx/+DHytBvF+xuJg41kNtQ/zl+:dBQpb+b0Sme5Cj/Xq271ks/Z+
                                                                                                                                                              MD5:DA48BD5666F29340A816E546E5CFF6D4
                                                                                                                                                              SHA1:7732306E14374AC4BD5D10C8AD5304F9CE7180E5
                                                                                                                                                              SHA-256:4FE73A4FE0A8178D106ACB2076E5C1876F31BCDD2EC4ED44147A4F193D746940
                                                                                                                                                              SHA-512:B3E89CDC8B172C224F6145D2E6769D850DAA4A16F785A5D7EE1FBB3A9BFB0B8D9AB2FB92FD0E4340EB27C57809A0B4AC45C426095F7BC4AC251A38640F2E39C1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:"..r.......r.."-a......a.aL.)...Nx4.D..;B; `N..l.....+_#.o.........o...66J..>5....sc..2hn...q..AD.:.Pu=93..p^...X.....O .S.~~..>.>j.qQ.6.1..=.s,....'x...E!.cC..1..jW.V..v....+".44..;...i.F.(...;..b....F..@._.".y-...L..F..+;..My....y#..vl%;.ts..f.JU.xcQ.@CN..N^n)I.F\...M.KA........G..].?...Wd..Z......e...;,...4."....<.2..).2..\.M~...2.N..-M.m...n....*+]....<s....S....S.....f..e.C.u.[.R...@..#g..v..ex.m.W...]%\i..i...NX.7.....s...].C...?.6....7.pl...S'........s=.....W..U.m3.k.....[N3..w...f%..........-..r.ZEnR/.........yu........o.S(.S............C..Z...J......y.F{h~....[.D<.oA.)H.1...2..*...3.S......+O.~...<<.h...uA}.VK}...tP{..(W..3...dS.mBP.zz........./C..N>.b...n9.....b....zV."N.|.u....$.Q....'rs....=...]....._.jc.g%.yd..bS.k.XC.2x!t.....h6..[it....h....[....D.f4}}..R.7.2..46t..o...~.....Mt.{..>..GVzs{.l#.`.Q...r.L...... .......!wa^9..U1`...@.......@2.Ci..b.(e{.............@Y.+M8.<.],a..O.....`eziP....+...>.7..\:'....Kh.S..\L6.

                                                                                                                                                              C:\Users\user\Downloads\DTBZGIOOSO.docx.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1272
                                                                                                                                                              Entropy (8bit):7.8703607025847235
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:b5FZ0J8HklYXIjI4vB+tqhcV2Hh2oLPjMntXsOxzzejC0jBNM/xJ+:b5H0rg0n2qh/B2cPjMnOkzl0OxJ+
                                                                                                                                                              MD5:5DC86A3DA83FE201259E37C7B6CB8153
                                                                                                                                                              SHA1:462EAA3E73D394A627F5495A2BB4B47983419F44
                                                                                                                                                              SHA-256:BA16E62DFB68C45C0D50376D9EB66E31A010A0F54426AE8C04413B4D381F02BE
                                                                                                                                                              SHA-512:7E0659D6D9074BE3261F3BC43599356E5F015744B4802AD7714E90041FC4B803EB56131C42BB7E8B76198873900F76A170F062FADE1C1B83CFDF2264A29DFF3B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..cF....c.D.o.....,../. ...R..B,l.(..).>I$.....0.......6..]!....x..\.b..Y..HJGY=9...L.\..Fi...E.*....'..T.8. 6t..!.~......p>...d.PS*u .[.*o...~.zl..oGu...b.Y...=!.e\BL\.L.]Q\Q..'y.z....V}r..n.1_>W........t...B.].....H..o.A.2...0...qp|...1.....7o.[......M..Z..e.l]T.9/..g..#Na..f.....' ..y...zWC.{...)..2...a.....:.kkZ^H....8)......3....._c.#:Q..5...}....C..9.9{...*.2.Xk.Ba...<..c.....#.~.4....).$b_.Q.Y.z.p...2%e......-..../Eg*....G....$.q..d..3...........s~&.T......L......BC_J.C?'.h..F..T.R....d@......Z..*U(p.....p... K....a........:...V"w..jB.C...7,&%.4.?br...e. Z.|!..t./....Mx.[c...=..........M.....D7....|Q..&...d....j...0..I.;...j.#.=...;...o....vE."...bOM..i:B...]Q.[......}..>...O....dC..c..z.G..]=W*.....&NSc...0|.<.....,.A.0b*.8H....B...!^n..Hc..g8Z.. .UA..A..@".?...R...<.....2...n.~7.a2"...!.6.....A....cnE..0.@NZ..m.\#.f...s.|....s..J.....(!9..^...2..Q.c\.<x....".r..+.c:K........].v...>..b.8.....S..I........`...+*......-Hz..

                                                                                                                                                              C:\Users\user\Downloads\DTBZGIOOSO.xlsx.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1271
                                                                                                                                                              Entropy (8bit):7.853354413212245
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:GPkDgNzOQLxAGv3JlGfqy+ScZsz1L6eU5/nCu66wD6S22Y+:GP5zOQLrvZl4qy+TyUpCu66M6S2z+
                                                                                                                                                              MD5:0DB97A9DC376B10AE38F4507865AD72B
                                                                                                                                                              SHA1:2C012220E82AD5A25B431A6815DEC4DFE5DD1004
                                                                                                                                                              SHA-256:3308BB2E60DB201F822C813C9E2749542CEBF99F2A5967CBB95F5C0A6779557B
                                                                                                                                                              SHA-512:8A4DE0FC454808B03D0E9FEDE0CD1D373945CB7089529C814094031B8E7AF959DCA1C4430ECCA6A85EFFF2149A23E016CA417BFB2FB0444E529E629B92F9885D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.@{..=....N{.G......id.!.`...;].g.m.B..k5.r&...$).m.F_.o.t=....w.,M..et...!O...t.....G..]..O..%...s...._.U..\<.b...+.z.....dYe....`7....:o....N.G.'.D........3....M/......A..~~...`..."./.....]l....tY......|r.\0..W....#.j3....}......e...:Y....|....$.I.[..2.n..B..P@..')..v....P..Z^Y".[...8.s...f......=./.c..(..q..K..]>...i.?.q..%Q.z75..f.P./g:.5Q...r.H.q.6..,. .\..m.....Q.......q...s.Sv.6......j......u..|.nH.io...;k.o..n..@.KK4y.R3+H...@.|...hWi.F....V=.....O..46:...I.].g~....dx........#........8..o7.oM...'p..9.W..z...~K'|..<...A.Y.\2y...i........C..7k.i.,=..T.%.?)G.{@....Z.%.k.Y.7..r/..K......a..A....F../.........y;.....;.@..p..@..|...?.....S..\.....\....$1%..@A..J...G#mR...A.j.9...G.^W.4bn.w.(..L..cO.W.S.].\uW........%`......A0[.6i.&.rlG.....v.. .b_...-d..@../....)g...p......gy..GH..<..}..,....D.XZ...r.o..v....s}....l....1C.7.0......R..*.z(...&2.L.....Z...9/.0.....?.cVp."....1L.M....}.pt.....x...>.f......}..K.@.......T.&....+,....G.W

                                                                                                                                                              C:\Users\user\Downloads\DVWHKMNFNN.pdf.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1271
                                                                                                                                                              Entropy (8bit):7.855114288786498
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:nHnXandI6OTMylycVQ6b+8VK0hdbhLaLNgJaYUuTHUNIP+Hkj1Qmc+:nHXeDxy8cVQ61DALNIUI0NrHkhc+
                                                                                                                                                              MD5:D31F09926031EA068391C949699E06E8
                                                                                                                                                              SHA1:BA2F49957266D4C903E9B8CE0487E0826492EC92
                                                                                                                                                              SHA-256:88BCBC949D60C36E328950037DB515CFE596F41A4897CAB9617A986071FD8D99
                                                                                                                                                              SHA-512:D069B271BEE8C0C0CB49A05FC3227261C201C3BE441AE009E9C62466117ABA907FF95E97D851B38E17730013FE5490E7B6527444A43905760C3D056C2065FC9F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:a..S.$..n..u..@..0.|ez....G.t..i^s.wR.....5.(..B...#.....b.:W..9a..m.#.a;I^..n.d.0.`[2..6..P..\.xu.3..x#....Z...k.>`r...;..T..3k.a.7#..y...!..u...K.GuNt.`.`.......bd~.b....{V.jj..E.........]j!.Di........vd\8.....L.........k.....Z..;.....".6.%.\.S.r.|il.uj..b{..A..3^P.au5.9u.....x..........X....B..*..n$dJ.6...a......3.]k)..2#..7x.i.O...{..z..%.|q.....:k......u......4.'./...x5..?...B.A.8..`...M=.....n.@..Q....j......t......J....G.=B..Q..Z.R..7.SgQN......G...m.qA..NJ..".q..%.UXk..l`..M....-#)5.D..L.J1.CAq_..._.Iz.(s..~s...E.X.le..`f.N.......m..d.y..>i.3...m)@.5...wQ_A.+..B!.B....cR.-2A]....... h....O,.h..t.y.j........c5...._m.h..S.._..2[..c`..t..9]..b.txn.....4-y....:<..E.Q...Z/;x....Y..Zx..F&.....6q..s.~......Y...t....&.L..6.......)d....A{.Ztd6\T%..Y.S...E.f v'...1.f`....u.q fk.^#. .I."g.Qq....h...|<}...Q.k..2..-^v.o...D.....x<.9........y@.Tk$..X..>."&.$..5F........v.v.WV.eY....F...])oT.......9k.L..3.`...Q... .c...S.?.ng6t.?.`&.E

                                                                                                                                                              C:\Users\user\Downloads\FENIVHOIKN.png.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1270
                                                                                                                                                              Entropy (8bit):7.854463468816668
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:Y10kpmwrC0XEd53rTwDkdpm0lO1YvDo2K6zqs9rcZ3MJ7LX0O+:8pmeCh5bTc0lOOvUt6u3K7LP+
                                                                                                                                                              MD5:D263F97C39F28EFD85C7D1BB6C859943
                                                                                                                                                              SHA1:1D1DA9255C1FFB67B09E4CC0098E151A26CCFBAE
                                                                                                                                                              SHA-256:B08ED860451B14402588839057B7EF03CF61F82D305D817CAB88D93EFC9E32BA
                                                                                                                                                              SHA-512:6BC300AAF4DAB6AB02347CBA385B042D841D0D61A7845D0A108ED6B3AE84E199328A207709536AE3F56F9F6E68A2BACF66963AB465BB5AABD52736A6D483F73E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..V..)..p.l..|...@0.W...i%......-)..8..sm...hC.9.g.p.. ...k....'....w.........y............Krq..43..X..Ly..o".T.@.......Z......"...i..q+....>...X.`Q. k..l....}....l.[5...h.f.$..D.~........0E}E&t....Sg6>[...p..T.....3...ZH-8.d.@gq....~.&..$....p.....-....B3/..,f......#.=*.)G..-..G.U.u)e...;/....6.V.h..2..D....8...}..Y...j...V;.v....B.....N......U\.x.#.Y...{h..].6.0.....7..#...>.w...#......3Ql...x..:.....^..Q$J!...V...Y...S...!w..B8+.....p.#[..x.H...<..).+...t.(......".l...1.!......j>..!(..~s.,.?C..".X..~...i...)....g0I1ZW.F.'.....c...Q......|%.D$u..V...........v=.A.#..+wDH`..C3....%.l+.?F...|.....NGHE]|....n...{.$...N.";s....?(X.<.ts..Z'0i.RS...Bq.....S.o.*..gy9bH.14p.9)].....f..h...'.o..OCQ..P.9......f.[.%S......J.....5..+.7=...7k._.E........#.tlc[X.G..:.<uk..c%....Z..[.G.*9...... .,v..x@.[..#.(....]j....S...(@.!*.....t..j..YV)....t .....z.5.A.E.K..d...F.^l%.l(@.......0...q!.n"....2t.4.z6L9.%t...<eb..6...:..%po....?.....s.!.[Z....

                                                                                                                                                              C:\Users\user\Downloads\HTAGVDFUIE.jpg.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1273
                                                                                                                                                              Entropy (8bit):7.855080301806551
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:kZGeIaOnOu6yNTpJ2ejNP/dEnPwejoYXTGrUXrYcWvV+ox8V+:kZfIfnOuDTpYoNP/dEnj5McE+5V+
                                                                                                                                                              MD5:054DB76B0F650F1D0D099AA6FFCF4D1F
                                                                                                                                                              SHA1:ACCB5B8743AA057EED167127197E0F79F1F0A3F5
                                                                                                                                                              SHA-256:E16849FD24F948555249EF522F8BA643FD036AE7CDE085FFA3D1E601D8EE7B9B
                                                                                                                                                              SHA-512:BD939E3E508395DC3730E1E3A83C447B8D980D9161D4C30FE07983C69073698E63DA12EA007663CBBD20E2D69DF5D31557B40AB24E9725A26B3F37C89D972574
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.m/^.roY..l.u.b.cj.N..BM.....D....7..../..."...?.7.G...\.!....x........9..V.gS..v.!.b..W...#...........6..t.j.:......XjG......g....!.....<!......H.c.A...V.+T..`^H..7..j... ./.cZ.W-..].S....r.s...t.|..'.{3.E.lT.TB..+....E.k.7.Zh..k..KW+.*W.!..|a..............2H..%`...Wq}....V.}......T{neP.b..u......b\.!..T..&.......@-?.'..n........f..o(...F}w..M.R$*x.......#....B...."..@.F.'.....l,.O ......:..G.z.....7..{..e..Q..*.8[...0......7._!Y.1h.`.q...#.ug....\!c....'.S...V#^...1R.:..a.2.\...,.d..xp=....-g.u...X...G}...8s9ij..XLi.qX.A..P...^.M.+.V.s..1..F..S.T%.I..i....#..+...8e....O3>e.....m.,`tn.V..dP..G...{.....=.H..Ze....w..t.9f....(e....Q.B'..2DW.. .E..(6...`4.sA....@!..n.y.Q..g..-(#....<..+.,..AgS.D.aG4y,....V9..9.<.._.s..=v.....v..l..o...?.yRR..V......?<.Z|:....(|...e`.V.PoI!3...D..I*q.d....._./....+b..S.........@...ME.2p.T.H.B....h'.<.i.i.>>[.P..M.j.n..k......&...h....-.<...3....u...LF&C2XC.$.........R..........].'.....:.o....|..|._(ID....Y.

                                                                                                                                                              C:\Users\user\Downloads\HTAGVDFUIE.xlsx.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1274
                                                                                                                                                              Entropy (8bit):7.860239399953863
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:h+mNHZOMWfKxPaSthEWcJR+Dwoes77MrH0u1sQb12QW3dn+:9ugNOWHDnvYBZ8+
                                                                                                                                                              MD5:0D0C14CB847AD2916FD8A9BAB9A308AD
                                                                                                                                                              SHA1:09F5355FE31983A93C891EAD11C85DB4E0B15BFB
                                                                                                                                                              SHA-256:14F2EB88871C1700FA1F178FB2B5EF072EF30B8EF05DF7EDD0607F1A79BD59CF
                                                                                                                                                              SHA-512:4FAD1D3395AC9002DAF2FDAF357E7508D88962693E00E234076DABE5F5C38342C46ACD20811CA1D0BB1F756C077702A54218038A0355407088E728E5E488B475
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.@3UQE/{E'u..r..a;.B.?..1.^..'8.$O3d.|g...*v.nj.W.G....Os\.u......"..T8.../..+.u.8.N.A...R..6Z.7.1.@.J......dH..W....?...I.\#w.Q(T...x$.U..`e.V.N.....]?...H...&t...,z..O.t.......%..T...Y.m.H.=+..-....M-...,N..e.%......_.F......W..]ha..9.n.oB.Q...,...J.....o..e..g...Bw..~..g..t...c..v..u.(R..........w._D;O].....cP>..2.....F.O.......\.4.)X..T.......S.^a.....]J...]..|..E@..JP.VgK..Jr2.....r`.O.h.l..".I;.k...#&....=6RS.Jy$.d.Y.X{.}.q).@...G..c........Gk......\.b.b.8R+.6d...........Cw-Iqz.b.q.L....9......Y...py..7...<qoA..(.Z..\@Y.._.].Y.T.2]...O.-f..07.......8.....0Nk...<y./..._nY#N.1........D.{.nE..9.<...eT.....v.."..Ha.. I..Iy.IM..+...K....G$jXn.Y.2.M2.?.n...L.AoCq.4....P....X.E~......Y.F....!..d........6..X..6_>.7\.S.[.4.E&..z..T`.o.....CP... ...*...x&T.*..../.-X.<G......F.0Z.......TX ?..5C...N..K.B.*<|Qf....cYd..E.;....N.c....y......O\..d.......q..,...(.U]...[..@_.PR~..qs.D......a.............9..m57..i.$,.[.Zi........{....&.zH..G.L. .k.^

                                                                                                                                                              C:\Users\user\Downloads\JSDNGYCOWY.png.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1272
                                                                                                                                                              Entropy (8bit):7.8562020591943815
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:hH2ybnHODrc1OiYAUPJuA2nsUe3wmUSn2xRlTyFmGfBOldhvwvE+:hH2ybnKrc5URuAWruwmUy2xj+Fb4+
                                                                                                                                                              MD5:C34B9ECAAB05B060BBCEE5F0B2459D12
                                                                                                                                                              SHA1:97BE70585A85060C92121522503557FE7D2D3E5D
                                                                                                                                                              SHA-256:B2A5C5712B025AD7C9BA56D6A0AC0308EDDE522C8E3657FA56AEABFE2EF92F50
                                                                                                                                                              SHA-512:2C27FC4A083AFBDA9FA2DABD6F8CC3F2CC1BA8A5B6584B128D6010356EFD2177C309D45C40A329C72368461F799CDDF56CA2597D36AFD7774A564F1D5E337413
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.%...m|.1.9) ....v6...a.NI.....gS.*.....Y..f...D*..;.g.d.9..N...o`<r..7.......3J.%[..b&...].F=...sD.X.I@..e^..p......-.......";...k.W.S...6.Q2B..g....B..6.k.T...:r.;.....A..vpm ....~.#..."i....Q....r...be..-..:h.b...t.;7..=..O......np_..p.qyU......gME...Uj...o..q.j.Q..B....a]*..[.I.n...d{...H.e..i-.<........b('}D...'W.m..r^..x.2..z'2......../x.(.....!g}.3.....d.)3....y.....r..z...?%..9."k..!.l......../.T.i}...M*(.....o.6.N~..=W.",d..'T.u[V.*.W.D....I$.U..E..H.]C.U..........0......;3Sn...-.@.....3..T^3.....l..V__,..O.|...g...?U.........GRn6..H...ui.kP........T..U..b..W.H......X],.B..........x5...oVL...T.t|b...4..S..$EG..r-.5..Io..y........._T8t3..e'E....Y.l.....r>........Qq..'... .1.4..lK.jU.Z..>....o..^.)}..Jon.#...dgK..u..C.A.`R.}....?0`mY.....\}.....~...-.,.C.kL.I.z.....o(=..... G.:k...b......)....j.....$...#..';.~.5......_.i.1:'.._~g.W8.x.LX..UVF.^.q.8...F..-......r.q..alK....wC%...$+D...../.h...d.......]..(...7.E.6.h./.g{.

                                                                                                                                                              C:\Users\user\Downloads\LTKMYBSEYZ.png.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1272
                                                                                                                                                              Entropy (8bit):7.86009330762908
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:w79yZ3FcNRe3Qc7D29LE6ouEp6Zq1Pr8pk+pyZZ5V3+/3FDhR+:AyGRegc/2REcklYpjaO9+
                                                                                                                                                              MD5:0B4BA7FA75C7B23682F2F13B33E369A4
                                                                                                                                                              SHA1:94423C93C560E7F23CF01B23C4C8256E08A994B4
                                                                                                                                                              SHA-256:CBA2D3A2C0BADEA84959FC98C9CE2DE11A22CC90E2F759D5A160BEF4C3625E56
                                                                                                                                                              SHA-512:6FA9814F168F07EEA2242D458B97B697ACAEB46C3265F3C6B7726392C9417FE52229A8A780EBB2E9840DA29E06A11D46A54F47942BC1D0A50C1820B59EFBF315
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..M.l.BR....A..\.1A=...<..{p.....&....T.<|.Y...VO...NLyKac/j.u&....^q...|..2...Y.v.a|[..]...^.W..s*.).K5.{2.8..*d....6. .|.p....m.2....M?..F.E..a.f.S.....FmY....>...6.G....L..V$5F...v....D.5.R..c...v... ...y..v..ah........M.`.. o.....?...XW..vB...H.....!....M%7A-V....f........Yq..jLp..B.vlVU.....u..x.2......^.......?.k.0lu*.H.tt..lV.....<a.'.....,.up.m#.lU...'CW..I+......$.I.i`...j1..lV.....'>..W.{q!.]..H.eb.......5Y.%n.p._..7}..?7..f......:1....1.n........R...-~w.uW....T%t..`.m.<.L9..U2+.....|..a.Y.!..M.z....q......R..#...D.0....T.....k.B!..\v..l...Jh.Z..[...no.......gU..!a*..|...l.a"a..._rU..:@@....d..T..M......N.../.2Z$...v.....V....x.......O..k....G4^.|.O.b?<...).r.....Hk......>....}..=..+......NmQ.=.....~....d>...~,.k.C7.c.D....KU....{....C...9.u.m...{Dh.(...%.t.!...h3....@3o.++.q......H..U.....c .L.Ef..c*yq.j.m...5..4.>).n~..W+~..7...^.al..km..\.6..,...^{JV.$....N.>8..=.<gHJH...?...Z./i.zK(&?....si.D. dz..|..#.%w....7..a.......p......0...EN

                                                                                                                                                              C:\Users\user\Downloads\ONBQCLYSPU.docx.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1275
                                                                                                                                                              Entropy (8bit):7.855857019705363
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:Jnk3V16mLB68L0P/SKhAHZdHXFYXt1APhn16GywlO3aWQyOy1zGC8fc+:q3V16mc8Lm/SRdmdGPhjyw2Q54zGC80+
                                                                                                                                                              MD5:0C1FCA6F98E209ADFC508CADBDF82790
                                                                                                                                                              SHA1:EBE894233587B90623D8EDFEFDF2BB1C382D80DB
                                                                                                                                                              SHA-256:4DAD6EF68F73CE996C07936D008D9C586937B865AD5B82E5CC32A28C7CCAA268
                                                                                                                                                              SHA-512:A5F646C42710371C29044A8C8960A598C4DC7C7B567C311027534DABC33CA3860B567C91532BB99020C9BCCD75ECCF34FE1D69B7BAA2C9F405456E0803DBC9AD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....X/..}........r.._..t3'*%i...-.....wZJ4..7.,...z.yKh.I~'..v:.......]......4.s.k..f.^......./;J....)..hr/_...........vs........L.q..v......2.. #:W8..5..Z|..j...)}{#{]1v..(..W`.L.Zx.(p.=.d...{..h.Q...4..A...&..H.T.gq...S.&.eT......j70\e....C...E..)...t.Q.!.....z.....m.*.!..d.M./..b.@.%.e....S.c.Z.8w..P.m.v.J..VLO.......z..f....8F...T...V..8..u(....mBl..o.\3..C.R..F...@...z.)eB.*.v]=0..z.J..'..u{.S..qd.F...2V..P.0../.B...].s._nO.1..y.B.T..f0G..../....@YV..`;N..:f..72....m..n.....;!..O.~.0...A"c.J.M..2....p..xT..vh.Lv/...K.a..n..P...s.o@V.l!.2z.T...>L$\....2S~..9.....J.$3..}_.5*......*.:...F....,..P.-....R]...h4E-.S.N.....r..~IV..C..._..(.*.!..l......R.......J.vgfG..~Wq...c.).5...J.d).RS../?.../k.jP.3..3d...]..........H7...-.g..G.B..#Op.<.ck.[.).;.b.W4.(..T.\.......)......c?.U2.:.=...5..I.[-.o..].\..4.............(1.*.A....^wi1.!.u.....e...'..[C>e...{i....R.Q....../M)i."w.m..=IFsBgDf.(M..=..u.x.WW..N....H..~....8.{O....z...HSR.b.\..?\*.x.....!.h._

                                                                                                                                                              C:\Users\user\Downloads\ONBQCLYSPU.jpg.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1273
                                                                                                                                                              Entropy (8bit):7.85080020001399
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:z09pmJjByrzDy1gA0XAE7HeO7xJYX1WjUZIOq5VtQuQyiMk3eWI+:ApAdy+qAeAECUFvVtsl3eWI+
                                                                                                                                                              MD5:8636FC5540F00EAEEA15F8F86A89D8C8
                                                                                                                                                              SHA1:A6AEC090CF1BAB35DBB2B9D644FEAF486D7370AB
                                                                                                                                                              SHA-256:48C2B0C0DDFD7E477D6A6CB6CD3EFCEFE0DBFCCA8F4B649D8D58CCF62CB267BC
                                                                                                                                                              SHA-512:D54A79624A1EFE59A0869304BE81A736F9AE2EA49D4F78D588061FD98C8B41ED692270F8DAAB1F24BD7FECDA45CD35C178E596E3CA5152E245BBE7B53737338C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..p3`.b...*.S.3.o.d...d.p...J~m..t.....T...%...Av(..K.J*~:..Z.Jk..E...G.s.E.._.a..'Xq\G.)....0F.~8S..kT.k.j..d...~.:D~...T.#...X..M..Q.%...>..&e..O.w..eE..|..m..O@. S..i....... ;....I.E>Us....Q..G....[pC..P4.........k...c.j.3-~..Y_?.v....@..Z;\....J.B.XHZ....'..[.ilC....#./9..w..'.9.....Wm..~..pwg.a..+.y.A..*.Q..e.@W.#..vi..C...2..*11#..M....$...B\.......V.Ql....`.y......-.cB...f..=&<..?............0n|R.T.V..s..\y...y..K.=n......I.qZ.........<..#./..0-..k....H.[$.lR......xqE\b..O1..Y.v.%.I..H.....I....lW...C.yER)*............0D...Z..`.5.w..u.....nV.-2g...X.........U.....'f{....OxP6AjD{.o.k...:sx...;P.J.u.$..?...H......8<...l].'..5...F..M...D(..w....w.DL...S.H..5.i..........2..$....6.........j..Q..U.S.. ..!....\~N...^wt.. .$].T...|.....h..@.b.YM..q.....$..z...B.......n....Wa._.<...bT,...r.W....i...AP.../...!..78......D.V....DK..gM+.G._.l).C1..!.....r^V.\..V.%?.....l...}...).U....)..'......D[...2.<.d.l.[...Z...`..1b.b....s.aZ(...I...}..?

                                                                                                                                                              C:\Users\user\Downloads\ONBQCLYSPU.xlsx.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1274
                                                                                                                                                              Entropy (8bit):7.850756713190794
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:YfCu5TDC/m+0yDJCGsxVF+LwhVgdSzxlhWgL9UbboDySS+:YfCu5BmC3F+UhVgkzPAgLCbbYS+
                                                                                                                                                              MD5:903C76D3DAF5E1874E9C5687670B2F91
                                                                                                                                                              SHA1:1D05FD156058612B75AED81976E9DA1DFD0458F8
                                                                                                                                                              SHA-256:BD6676D964387B92AD60E9E3CB2A19FBBA3621038E6FB9BD275E9AB5D7494792
                                                                                                                                                              SHA-512:6F8C144BD0A634CFEF11E919748616E8B83C984BE69B00DEE7288E216DD2301F22D77ED7A018B9CAAF10BCF81147A441018749217E7D165FAEF7EDD75378B071
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:>.J6.9.N....".p+< \cVA.....S..W.MF.vTg.@......W5x....x....T..<..G.%.x..]rt*...*.Q}+1..!0..V......}...h.y...EJM:.J[...UZ..s.m*..i.J.O....=.mx.9.(+.o.!.V..B.eU}6.\.......I...?.^.F.......<.\....U.NT.g.}}..=..oH....?..]....#C._.,.......xa7.#W..$@a.i)....De.>.d9Q.d.}.I91E......n.#..6..!..z.v..]gd]...t...h.B.....o`...>I;.:..,..A8"H^...N.R.H{v...}../..L..r.........$..g.G.sl..3.... .......u._.K.=p=.=..J..&S..^...].U2...u.....hC.v..._.[.#.|E3./..%.0.?:.a.h..O.._9H2.+O.`p;.,.$.m`,c.s...@.(.T...1....UJ."...m.Pea........2..7.l^...."_YT2>..p.).QW#....:.N......l.`{.E.>...Ou..v...#...q..H..........0LZj.{..\>../!9.,.n.a..u....g.a.........N.gFH+B.khN..2..%0k.I#2.r._!B.k.w%..i,........t.....5....ZM.v.A....<....I.....a.6.M..*.dG]g...W.ch....t.}....V]..}.Y.G.....=$RE..y.....e..ZdI1yn..z.c.*Z&~.1o......*.4..:d.iR.!..EG...%.tL......m.E9x)...=[..HTu..0u8....85..,O4..........Agr.....i3Y...K. X.*...#"..)..{\J..X"..'...b;..........:`..%=.../P......92n>...

                                                                                                                                                              C:\Users\user\Downloads\UMMBDNEQBN.mp3.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1269
                                                                                                                                                              Entropy (8bit):7.8626780797595215
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:6659RuajjHh7nPcvsG3OJm78iMvKTfbcEUaT545Vqjz/svhcYJBcsvBo+:6659RTHFnk0GfQVY55fspRcf+
                                                                                                                                                              MD5:DE7ED6AA8FE2E4D1710E4A09399E5FCC
                                                                                                                                                              SHA1:D317B657A6B7D1612E7501F4B94C8CFF8987D1CB
                                                                                                                                                              SHA-256:ECE06A21259ABAB73CBA8DC5B8016395333D21B4C924AD0B642293298A6C8592
                                                                                                                                                              SHA-512:00491873F2CCBFF5AFE5F45F758B9E6133D84C7DE2D2AB8148838E6D739689F28232E336BEB0A69D411097CE0A5F4DB4525C94647D8798F371887F52E3E89728
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.<..Z......8G.j......6..i-Q....6...y......p...F..I......\._5.......>....{.....7....;.t..r.........WM(G.*i.#..]....?.K......a..s..q..;^...... i.C......2.omB.SO....3..27......~..x.DY.&4.1-..y...H$.N.Da.,.....u.Q....:r.&.]xO.?NS........Y...........d...J.Z.!.q|.C.b.[.Q.o..... c3....@Ri1.j.+(...)j......A.4....^.9..P.M......y#H.f..@....=....5h....c....G.)A]<I........Ol.L.}_S.>r}m........B(..Th......x.....T3E...y,?.u...m.s..8.."..^.#...T....&6.....#:. .VcP..LK."...&."".?......|.;.+f..w...3.)..AV..U..v.a.0@..<..l......K..N8{..N1......]?`.....)..b. ...[....*%yT..S...}37^.....e../..^...7.|:..Q?.s!U..a..L.k. .;.gY.A....lF...{P.G.)9|.........h.4...Q.F...[#v..Y....;.;.s.%G~.-T.2...._.f6g8VX.7..^.=tC...@l#..be.....Be&(u.2."...)....j.._(..G.....ZvM.!..DA..e..%....&h.....".6?.....T}...|....../.5`1..P.@.......z.)Me'..U..|*..l..|..+T........h]H...'.P...0.p:A.~..%..-......+.V.Rw.F...Jr'[..Z......K..P.."/..K...B...b.H.tcH..k<.4.Wl....l...........y.....d..Q....

                                                                                                                                                              C:\Users\user\Downloads\UMMBDNEQBN.pdf.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1269
                                                                                                                                                              Entropy (8bit):7.85969708637093
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:DGh9BVYXY9+VqeRIcTM+qFCoZL6FbfPPk8WkzCRQVpU7YkPq+:DGh9so8VaXVL61fZ8cpUy+
                                                                                                                                                              MD5:B60CDEEF64E781358B31D64F8A0F7F15
                                                                                                                                                              SHA1:3D69F459B7F4AE6B846ABD6E89DE8C2E8AA8F138
                                                                                                                                                              SHA-256:00CBBEE2EA3EBE9E310983D5D2A554BEC8FDF3DA211FF3811F13382590567788
                                                                                                                                                              SHA-512:5B189F4B8D9B444825F8FEBFCC55DEB2BE0BCC7DE7006F0B1B8A91F2A28CA1F0E3279B57B1BDB2102CFB3FE1070FA4E51ACB162050AD700D4AB5334AB4DA6035
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.......g...C.g.....tB...|........w..d.|..m`p'bA.,.........E).]....z.i......p/...WJ[jG.......).D.q~.....f......)R.D....J#*Wo..V....P....[r7..k.."....3..K..c........S.c/.....f[......I..M...Z.>t#.fN.W..U..j.).[.$3.&.%N..lgN.).}.6.A..pe.;........yHR.z...)<J.....|.......R.....E.].....P..2....S?...4.....R.......V7.gJ....6..]fT.M.hS..E...3..6z.yw/j.TT..Dx.......3.~.....<..>.jL.... *.h....g.YB >...V.'}H.#.....:.X...+.*>H}.....)...........ne..7..5......O.e......c...l...5M9.m9..*.\.pu.Od!+`.J..:.&+.e+.+..3....E4|a..UG.,.#....e...L.i..H!j....t.].Jp.-.-.|u....b.p..Bk.......Y..3..U.s x9.'k!.....I%^m...#.q..Ov..F%@....W...;tr9.J.tq0.M........jf...8.c.h.pjY.......o.'.O..P.#...,B{.1I./b).Y...#VF.Wg..}8.....?.4$t'.3.2I..|F.6....O...I(.....)hqZ.gY.Y.....;.Yl.].n$.>..p!...|<...|..i....f..a..b1c.rE............i;4lE...w66..\..^.q.....u.3t.O.B..=..F..r:...R...)...TG+...7d..x.wc........:.....u.B./a.3}.&.!.....2a\..xN..3f}..VR.O.....d..~\Q+...1...........z.Ob=9

                                                                                                                                                              C:\Users\user\Downloads\UMMBDNEQBN.xlsx.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1270
                                                                                                                                                              Entropy (8bit):7.8494929611239765
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:G305OvBjFdNj+/DV42IyJIWGBgG0eyKEU/LeokvmPdULHAs7G0HJS+:wYOvB9jCVO9yG0eXEUj7UNbJS+
                                                                                                                                                              MD5:0D92CD4A11EFD1555B40948AE8790976
                                                                                                                                                              SHA1:A0747AF1BB6BC5FC76AA2BDAA8FF7D54985BEC2A
                                                                                                                                                              SHA-256:025079085FBDCEA75E5E9D65963A70F7719E61E5B224D5F804E9A1B2A14E153C
                                                                                                                                                              SHA-512:11E5F38DABD6DFE8E056E0A0CF18FEB1ECC006DCEDCDB46CB0C2BC3998C9731E478F1F89B1A43F978788C9C4BFCF099BEE982A32DC3A8516E0F84DB3FD2841B2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..F..vs..F P.....`..%..)$j+WE.U..........Yq..........a~!>s2..t...9 ..........8..hA..=..jE.1...XR+.8/$.5......G...7..W4.0ye.......9....]k.Z.1K.a.m.7K..o.#-Y..[....\....g=..B. ....F........]..%.K;I..../B?.b_2.Y..7...$...../..n.......a.......(..1....RS].A.(:..J....a...M.&.....v.:.a..Z.}...))I.vqcq.p6]{.F\(...../..'m..eq.....H!..&..jG`.J./O+..T.b3....X.O..d...h3A..V1..yJ.n.+.c....`.t"L.L`.....+.vK...Ye.4......[Bw...o..Ty....R.+r.0U..$..^..3.laK..sT.2.!.......l.wR....#c).U..h.\.....)h;...aj......_..._...n..P$R1.,.y.Y..m..V.er<^.p.%.I.0..ZE.u.;..+..t..&...w.<...$.v.."@..&.....E..V.oF^....=.].{.y f..9..C...|.c~^..=.`Ydp....L.5...M...wBS..;.`g..Z.oGrq^q..c.!.G=..]...zo....9J.VR>3,...T..a.......e......Gx..c....."..b........@F..$W.5.x8...X...^.....a{.......wGd....Dn..=.#...$zy`....6.....?..8F..NT.9.`.<.W.......A.F...&..p..(f._(.w.....cBL9 E..P3..Q.s5$.z.w.=..0.W9.<?...2.......;8HW.@;[w.-p....S#.d.c8...V.PBUF.0..r7. c%bR...&.*...jX..f*..lhMmq...7.

                                                                                                                                                              C:\Users\user\Downloads\VAMYDFPUND.mp3.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1272
                                                                                                                                                              Entropy (8bit):7.842863156678089
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:iBJ50OOVDkb4h3eyg1AYh+IqEJWiJ6xA90emucQMjRuNyDuEynWNWvwus/++:kLo7uv1AYh/q4Wg6xArxcQMFuNk2nWQo
                                                                                                                                                              MD5:7D66060A60B6E6B19384F355F382BECE
                                                                                                                                                              SHA1:43D266E3E97939CB5B808CD977CF5C1A449CD5B2
                                                                                                                                                              SHA-256:DC81E123763016B23663D932A5768B42AB148273F25F9D2A5367FFAB799DF5B8
                                                                                                                                                              SHA-512:089471F764018459ADCBF706D75A862353F27C13EB565BF0F7E15EDAE1A19338FF4578B618FF77C50FF8AAE53AB8C58539679EC9A0EAE789EA4C4672684C6750
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:i..l..X..[..O...2....&g.q.t...K.$........W....x...M...?6..~.;i..)......%...'oG.g..Q.xe....&;w...+.R...K..k..B.....~^.s[.0_G...6.f..;.2{.0..s.^......<..T...A......\.-...#\.)...;6H.....H..c}J]....-.CQ..N90v......a..N.`9z..6.Nt]....b..^O....K...(....G.n_..3I..D.=.....Cc.I...x.,..v..]5.....jE/'..c$... ip.g7.s...{..;.VG.... .~.=...]'.W..^...<..!..x.....uOr.I.N..L.>{...:^..L..o..6.67...h....N......g....0x/.:E..j)P[......f.FZ.4LJ<...r.)l..U.........g...c.........$n..`=.1!8WWkNQ..E4.?{-....9.......C......p.x..a..Q...."...a$U#.c./!R..&....rsq$.E:..Zs...@..3k..y..T(..S...f..\....r....;4.S.^...L...p..bZ..*..[\...q......-....*9........Hh.Jv.<#>...IM].b.Q[<.g....W..S(.y).rp....i...<...zY.(<k....s-lx|.........S8....k..2...S.]arS/.....@.hN.>J..N.U...q....;.g..O.t.....f!.8..BD.....7y..=w..>.=V....To.i. ..Unk. !?...<{....M.............Qb........8....9.....#TQ..6...~.4..>......EI.gf^S#....'.....O.+....K.q.T+.)`.....f.........G..WR...6.S..)f.Z...J.F.

                                                                                                                                                              C:\Users\user\Downloads\VLZDGUKUTZ.png.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:DOS executable (COM)
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1270
                                                                                                                                                              Entropy (8bit):7.851704558134043
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:uXs9dGQ4sL4iIRdXQf2zqj/sZVa+IcN7hiY+:uowQ4sLORd620EVJhv+
                                                                                                                                                              MD5:41B2294E8E99FB9C91964511B5599F57
                                                                                                                                                              SHA1:A0F3B093F85F0D890A43526FE62E0168655975AF
                                                                                                                                                              SHA-256:60EE09A7718302BB17BA6F39F4C0701A7A0B03E441C2967632A31F251C7636D5
                                                                                                                                                              SHA-512:0C8BAFBE6F8822D0DE0F4AFF5EC0B7A492540624F95A95C052F53575A6045A85DE7167746029C650C3230028957BE0F6B269A599887A4A584098271ED87116F0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:...*'J./G.%.ler.WK,..m}8.?9..gD|..2X^.h6..\.00dr..uyFC...9..=.q..u.{.k.....+."...6.h..7.YP.gGs.,..X..P....6..X.J...2.r.m....l$.P..Y~...O...o..J.J.6v.|...")..z.....9\..GM]W....Fq.N....Q.y...$..&d.........@.-0.x...hq.....M....."...].:U.R.......e.:...P..|u5r.s#]2S.J.. J......)....5......<......E.R.P.]L&.Fw.3.".6\../x..... ?...........l3w...O........+\.]..Dy...]wT...V.R....'.0...(...M.1.....&.cu._+.e.... ^;....Z....m.V..Q.C.W...e.:.."m"uR..N.k...A..'H./(.?..vOM..3.k.z...~l...8...T....qo`.k......^vw+.......G.....}R.`...oy..?4D..(.$#G.:..............3T...ah..PL..'..J .1..........dtL...<s..%B.:HW...V."U...I....6D}...s....1.Zz{.%@....&@UF!.v.Z.>.c.v.nl.f&...t.*.70.OO.)'.;.v/@.~...o..vj.~.VK.....|...Ie........]HO..-.jK..2! ..j.=.c..Ok.&Uo.!..'....}-..iQ...!........j~.V9.;....J.^..).qi.Ty...?..F...u....D.b...?...(.x.'...&.. `......K.&.p..p..8..>.Ya..l........j.wo.ge.+.r.&@e........s.j.7...:_.g<G...S.Z..7..4....v........,-........&..

                                                                                                                                                              C:\Users\user\Downloads\WUTJSCBCFX.jpg.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1272
                                                                                                                                                              Entropy (8bit):7.8565805429792865
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:W0K1fqg0kE1quEP39/NiAbVhCkILjk/mkrLo4GNRpTAdh6+fTm+:WQg0kyquGKA6Vfk/BrLoLVK6S6+
                                                                                                                                                              MD5:2B351994CA7DA5B448BD583724FAB91A
                                                                                                                                                              SHA1:1BDD3B055B43C264DE9FCABCC634DF8954EAB402
                                                                                                                                                              SHA-256:07759FB95064250F3F3C77EF88054D0EC5B4F04E4008BC487C5A18EC50965395
                                                                                                                                                              SHA-512:81DD68B0F118C6C48FD2ACFE66EB7C0AE9AED818804FEA9B3702F0651811F814369982099A68F54AAAE0DBC1F2517551EC426FB6D5093D202821C3E6E05B2EEC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......x...&z..m..E..'<..p.t...m...`3u..u..2...l..=.4.{,....=.. v.S).....=>.a.@".dQ..$a.>...h.. .U.y...Cz.t.!@^.@[..A.>H.{g.<...y.....f..\.... .t-...i..7k7..!.6z...U..:|...A.....O....jU#..,2v.Zo.u.ChX.t.....<.|N.9t=;.......PI..Z.....\b+NN.....A.D.A...v...d..Q~a...A....K..).;0.1q..7.aT ...(?`....U..=NW~.3:J|...._.Kf.P..\.[E^e.>.L..D"...d..@f.]...a.........;$*2...8.%.. .NW.....8H.XX..&)sY..r..<..LV.I.W4.&.....]9.S..).......(.;wZ..^q...y...(B...Bo.<..O...D;W.7.S.....mu_.>-"..."1'.1.%.0dS?..,.q....y...|.;....$j.6..%0.....p...Lwt9..G...%....L.H`.=K.aa.z.....5............}..3v`..A."S)..e.(...XWF..@)\7....Z.. UE.......&.......Fb..!+:u!:.....qE...w.........../q...U8....,.|...^.~b..t..>......P.-.^Y......_..y........LAY.;H.O..3........b.Ar...h....-......-......Qk..e..c.....V.<.X../.6....Z.. Ud5..J...1.nL.....F.c.+;..M...kSym...G..,...&)./.*."......{..sRB.j...T.&...Z.$[...:..3.:...|.c........WV,.5V..n5...\v...E....['.}.m]..=.....R.....6...".F

                                                                                                                                                              C:\Users\user\Downloads\WUTJSCBCFX.mp3.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1272
                                                                                                                                                              Entropy (8bit):7.8590324428233
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:5C0+Mr8koNEDNK8cWidcz3x21+UZREirRP8Rog1xp6pV6zfe+:kOoN2NK8cWTN27o6g7pin+
                                                                                                                                                              MD5:76B113AED116DF1668D5AC534A2EAA79
                                                                                                                                                              SHA1:F49BA9AE4EAEF8FF4E67594479099B9879701312
                                                                                                                                                              SHA-256:EF821AB02A087C19D6DE04A07319C9CC884E4A120E7A0F188678D2A80FA0E0A9
                                                                                                                                                              SHA-512:F14365188DDB54F96ECD478CF705BED6F9EAF213CE50A65263D38E9A478874DB5F7574A8A715C17482B5A5D0FD0348645DF2C9A63CCFDEBD5DBF895458500018
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..5..Ul.r .......{...&P...-.p>.5..TUCr......(...(,1l..f.8...9...y/...s..` ...!....]d.....r.X%....\._.<F.m.>N}.W....F&..j.....S.....m..?..%.JgD..u...).|..E.R..@..a.%..G)..:.....DA.m...1.....<.*.x...5....+.&n)............N.........._...[B.b...e....T..5....C#Nk....Q4h....|.~..N..tK..."../g........o^..6|.~....Oj.\u..A4[Kw.k.....;D...R...d.`......O~G.d....+..&...lu_.k..Z..g.T.d..\..(..:...b.]v.JU..+_.+......O.........)<.W...2O.....oc.......g...."....K..)X..1.Q):.............o]....I".6'.......f.".j..%u.U......&..O....8F...BB...s..%.......-K.gXB8.J..U..e..ip...S..N.`X..t3..$.FmJ......#V.....d...B...M.,4....3..)..J....=...........~...)`C.qr......X.a.h.PQhD_9u...B.2.......N.N.}....q.,.V.d-.O.......V#...X...MC+.v.9.ZG..H4..3..6T./1.a..vm.Y-j...H..c.$.E...-....n..v........C<.2. ....k..Yq...Eli.+W!.3..yG.I,..XX..&..Z...}...#.)d.w.$..,c.p....[o%.G{..Fir.j..(C../......<o..3.....h8:..e.\.t7P].e....7D......2.B.m.7..7Y...W.......6.^.=.:e..["

                                                                                                                                                              C:\Users\user\Downloads\WUTJSCBCFX.pdf.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1272
                                                                                                                                                              Entropy (8bit):7.853371145291307
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:sQ4jTOWpWkKZLxD6Q4BjpI0/T8yFt9R0F/2uPUU3Urt+MPBiJ+:i1snv2k0/T8yPzO/2oUMUxD8J+
                                                                                                                                                              MD5:EC8AAB6876E02EC7CD4A196E5E550787
                                                                                                                                                              SHA1:D3A957C6630BFA72FAB437187255EAE5435C50A7
                                                                                                                                                              SHA-256:1990DE9EC31DC00775A0A0B5F51BEA03B945A859902714DF57C9AC21329EF8BC
                                                                                                                                                              SHA-512:2B0BFE37A2C99E855CF810D0B32516011FEA1EDEC25CD877191837B935AF884E200B28BA1F80AFE9679BEE7EFF96502D141F629DD5F4094BB774AC2238218D7D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:04.p.....=..=Y...>..,@.....~d'.............j...<.*....o9r..n...%}%.$m&.BY..?.8.0.`Zg.....=...-....9..py..l..n`.....|....~....E{\._.....M....C...8.8.....a#....2L....../CR^Ff(.i..(..*.p......`.....%%..i.N.....v..e.6.2G.....a'.",...IH...Qo{..$K.I...Z..!9G.zF.oU.4;i.q..e.JqL.....]....BT.xF..z|..:..~......D>{......k_?..^]..|...EI. ..1..ps=..~....C.~..8.jDk.[.c..$,......g.1..............k..*........q.=..... ."...._8........R.aqc...K.....o....?..x..$[l.B'HSR.r..&H..k.Y;n.a..:"Fv.R..a.N4.T.=.| 5.7.d..)w...@.A...Bn...fo...q~..E.........f.u.n..L..._y.-..e..../7....W...2.4..N...<.0./..e..V....K.....F..s+rof)...]^.X"..[@........ ...}.H..1.[]..x.VE.n5..HQ..1...9. ...jy......F.?....9F.6....4.<....6 HP......$...!.Q...-~ ..\...p.Wmf....lz.^,!...QB..q.1).........vf..B....a..se.h...2.......{.h.\d....u2...I..>.F.Pnn..N....SZIRz......}.[...W..Y..Y. .I..b_|E....G...H......l.w..N>..n.........5.M.g.1L.f.5..Y.TH...."..U...{j....m..K/f. ..|.."'%.G.hG..O...`..

                                                                                                                                                              C:\Users\user\Downloads\XZXHAVGRAG.docx.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1272
                                                                                                                                                              Entropy (8bit):7.8277515123687795
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:MpQeGDOPf5lessjd0k7CS0jLINBYjafxQe2H+CdZ75lbOPG+:MphJ3C0OyIca52H+Cxlb3+
                                                                                                                                                              MD5:8C7CBB9BA3C21DEE30D4A15CB703E5A6
                                                                                                                                                              SHA1:2FC4150640A9352390FA66AF40FEA6F2A8BEC47D
                                                                                                                                                              SHA-256:989F19F2EA33A125F350563C35EBD3C961CC8125EB1F12C16BD9F5332D117AE5
                                                                                                                                                              SHA-512:6754E585AD388C4ACC37E91BB22106D775385B6801377778C66DFD4B4E3B3F55A78A0837F90FAC7345C5ADDCA0303BE5273DF7E9FDD210E6DD6D605471805B01
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..9.M.8..a..-.....Fh.`..$(1...y.[..A}...q..J..fI.T\..a.u.?.:>3...$.V.<c.di..@......:.!......\..t.6]..H1....(..t.s.W=..>[. Ga..~v..3.f...wUyW.../.P~@..w..,>....T.z.\0.6.....:. O...=.e......=..L<..rT......s.rP...mFR.e[i...O...W.l<..0...O..c~...g1.`.<....r..<7E...g...t.r..)h.6.HN..`.=..$<.[..=,q[m.Ow~bF....p.>..4.s..1%J..?a.4.j....j64......:.F....E.]5!..>..|.+.B.\.....;..uyNB...4.....hsS....P4k...........D+..sI.........4....@e.4.r..K.V......M.~.%.7..D... ...p.l..iC.\)...F...yeH.m...}.r.O+\1.U.+....@gq.+....8|..Gm......\....L..]T.......3.2a.F.X.....=.?.>.k.s($...../i...=z.y>#.+P....O...|...B.c.....k@.....no.[..0..... ..4.Mh.d.*v.d......\z[.@...B .(..I...Ki%1.q....%.#...&...M.`.n.Y.(3;.g..2.9....{.}...>..7A.<...O...2.J...Z..,.....Hw.V..F....V......#e#f.F~L..MB.?N.../..mj.r..j?...`.K(R._.........r..0.....0WR...4....3kQY.BB..k.<....+\....M.w..G....h.`GR.`a....;.yk".._.8...z.R....>5$_9...lr..m..!=........#..?.aX.H,D.....=.-...k.>.&.f>9."C...H ...qE. \.0...j..7.Ki<...

                                                                                                                                                              C:\Users\user\Downloads\XZXHAVGRAG.pdf.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:DOS executable (COM, 0x8C-variant)
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1270
                                                                                                                                                              Entropy (8bit):7.836009054858812
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:Lc22lZGgxI6LDNqiwC/GcTL//QM8g3hj/QlliBXuMo2D1+RtJpJ+:LP2lZq6LrOcTL//b8g3d/+iAMo28/Jj+
                                                                                                                                                              MD5:0D8EEA9E4B3A99D70A01A605BC774D1F
                                                                                                                                                              SHA1:AEDC67840A6F825141CAC3D14CA9AC37CCAAD2EB
                                                                                                                                                              SHA-256:2A0C7B1CCC8C60E61E6562020A836DC8BA8B800B6B91BA47F65D16B0C95A1F1F
                                                                                                                                                              SHA-512:0FCE54E3B29AD2C0E93CF275A659254D4D7FCF318CF09325E572A5ECD0610252DE884F5E530842EC3CF829D5366A084387B534BD1B5DC58088B6BB2938C65F83
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.%...^.2{rq...U/.v;......C....^.j.K.......H.^/.>l..^..p<...d....h"T*.K.d....t..Hay..t.+^.k.cM. .9-H.D.w^..&.0\..d..x.o.'..{....29...0.`&..._..qME.Dtt!.S..r.~.sh..S=U..Cy....@..U...hn'..:.juz....+k..#j.-X.....y.01..N.o..L...&{...W.M.U..E........77..[..t......Pw..19.:..9..^..3.4.[..E[.........!...q.<......x.$UNH.....q....g..=hQA..."\6$.K_.@b....A:.'=;..;........+Z..`..x...h...i...uiA..V..xB}(4V.j.\.<!.+>.d.../........I...Wf.M.i+......Im..;!.p............J.Vj..K...X....xP.^.Lx.4...r.P.l...RZ....-.E....:.-.;. .......8.6\.+..b..C.n.Q vn.H.h.G{......42......k.#.h.".K....k....V..n.?K..RT...k.*..g..vgf....k...y......{....u....]+.P..L.Z<.ao..#s.......B..s3.ih*&`.Pj..cX!>F.\.<..r.:....5.g...DDV.G.4{Y.-.J.Fuj.mp.........Q..A7...S/..O..).....I.=.....p.B...|..........r.....w..0..w......h>o.1..R..h....k.;..9...{.B#.2Ld...>..(.%.....v.X....~..j.v$......B.k//.....4.6.a...@.T..d..C...I.i?#...,..c"..0.{.S:.....W..*......x.......`.\u..%..*..

                                                                                                                                                              C:\Users\user\Downloads\ZBEDCJPBEY.jpg.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1270
                                                                                                                                                              Entropy (8bit):7.851673119037382
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:bgRmF/LuU8Q2pNN7kRQrsFJ//w4fne4O0bTVSyxTC8pMrItmESg+:bgRyu/fGoWeL0bTcyVClQ+
                                                                                                                                                              MD5:60BC5CBCE76A58A4F8E153B1DD42228A
                                                                                                                                                              SHA1:361B469DB642551D62BF9BD725848CA3D501C001
                                                                                                                                                              SHA-256:75DACAC258A59BC85B6B70CAFA168F29BEE7C463D9405EF43A673B68ADA2B2CE
                                                                                                                                                              SHA-512:61C62CB06B8249DCA7B5E33A363A091E1DC756FD3C8DA51718F6B4739CB8122301E93D0F21E07D4E0E9376E57F534F66CDB4C74F63D49EEB564DFBA9A22DC2F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..I*.Fv...p:..s.d:.....g.......N.'*......j.Oe7.V.&.Y.QV]v..|K.m..//.R.K{<.....5...../...%.*.$Z.M............6.S./+...\.b..4c.!`Z..5..<$...5...P..H.D...X.L...........-.....bi..M<a....%..x..../@e..9..@.m .&.B[8.p7O:..AaB.....$/E..[...a^......A.....' ....o[A.ti..,.6e.p.....E.~..$.....|..n.l...ID.........B....c.&.".$.q......0.O"xW...Mn.......tH.xH._......6..L.s.....t........).|~*.4M...."..._.t...{.W.;..........}K..&yZ..../...O..d.....o...<C....!;.\.....#..#-...(.p.wH........$.^D...#hh.....v/. ..~^.xb..`R..l.J.....u..y..lr...K..\Xj.JU..lH.0....nA.......P....O.pF..jY.M..K..l.|.......=.G.4.A..T....q......oIZ.}........).n...\...Q....U7...(8.~$.wu.N!...8..3..l....\..s..|.M.....lb.9.l}...*.[..T.z.d...v....T..h.^nl.3j.J...#nX..........p....X.y..m..y|=......cc..t@.:aB....?...G..(6e9.1.w.L.......X.".1.*{............R].Ly..o.aj9N.=S.K%..1....}v........,S{.lFA.2.........'........H[3..P.v..f.ES.6.\R..D.[.........v`.R...O.h.z...u?......bD.Y.A.m

                                                                                                                                                              C:\Users\user\Downloads\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\Favorites\Amazon.url.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):350
                                                                                                                                                              Entropy (8bit):7.397005246048911
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:EfPQ9cYzRDpUMeOXk39j3fzSQ3gTth82mzyrcgsScMMUnK9Y240pD:ePTYJWDhB3OQQTz8y3O
                                                                                                                                                              MD5:B28F187FE19B5CA0651F905494F6075D
                                                                                                                                                              SHA1:F81246B1E9F9812FA24B5BC7E788DB292C9700B7
                                                                                                                                                              SHA-256:CF3B288FF2B84EB634AAA8D85E389951A458038D31C2356709F7630C5ECE831F
                                                                                                                                                              SHA-512:D9D433C3D3E85914BB54F38135F386348D6D623A3A124F30041D92405ACF46AA4ABB16246DEE8DBF7B56110D97ADC8265471E9F57B4AEC7E901ABEBA0C76CD3C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:C.n..]..sO.5.-..HU..2$...6%....O..j.......+L.aP....F\tj...V..z?.@..Y.3K+.5I.#T..Q...Ru.T... 5.<...!....cR.~..9..%..........`.....$...ct... .$.t..i...-DKS.eL.....}...&8Qv .(.....%.^.......g........m"s......i..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\Favorites\Bing.url.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):443
                                                                                                                                                              Entropy (8bit):7.4917555872395285
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:HtHHsG8YZDt1Jt3LWYKU52u7j+DMx1MMwDTpTUXQspktA3YWUCZzKcgsScMMUnKH:HtHgYZDt1JtbHB2Mj8FDREtGbSzc3O
                                                                                                                                                              MD5:601212117C434B16F59A8592B6624D8F
                                                                                                                                                              SHA1:AA255DB801A35DA3749DF4F635E8A52DCE3BE9E4
                                                                                                                                                              SHA-256:9E5816E130BC779B34AE6BBC031D54DF0FFD460922A5BC785C2B5F05616B9756
                                                                                                                                                              SHA-512:623A80BCC4E516BA0476BED3927E44C7D78AA1DB989B963A1EA03D1B54D4577DA08CA95D6845DA8B22D9DD30FF7CF15081F76BD415EA8141E05B8939289034D5
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2.#.^....8-S...].m...2.1..'.y>.[.A@K.y..65m;h..^.\7m..4.bc....t.CK.,......F.....=`...W......s..4..Q....,8.7..x..vF...ik..y:..u..|..>@.QS.5N..S.$.9..3...k..........]c..;..W...... ...Gw..~O0vR..9..*..L.....a;I.>y&...ct... .$.t.......\..;....o.6..ked..4.:;>_....e....T.7h.EN.K.q.$......a...e..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\Favorites\Facebook.url.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):355
                                                                                                                                                              Entropy (8bit):7.4149870820541635
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:SON7HWC+aCUsjluHgOAVG/vURSJsASKq/10JccgsScMMUnK9Y240pD:pNr+aC15Igm13qKS3O
                                                                                                                                                              MD5:EDC17EEB1D25C529BC0101219F2D5030
                                                                                                                                                              SHA1:8EAB8B437C166BE51A0A82E5C69F8B4B394ED675
                                                                                                                                                              SHA-256:86DA5A6DABC702F9E3C2450A7973D19028560AA6A5653231C2E02A6C1C0F8341
                                                                                                                                                              SHA-512:2FBE282144525B495D85FCB53D00B85F34321362517F45A93CE1496CA46718D6FE40902EA70ABAD37E412D8D246AF3EF2F9B48E620976CEF23CE81FD7903A545
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:s0.d.3.s2+...VJq..M.G.."..X..a^.37t..3....=#k..B.(^.:..A-...r.<.....)....j....2b..8...Uj&..h....C5...O?4bE..A.9..'.........>._wJ...cn...r.$.t..i..xt.I.$uf....$...:Dte..0..<.7..1..../Bg...)..0z...Ah*y.....M..&U.l..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\Favorites\Google.url.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):347
                                                                                                                                                              Entropy (8bit):7.3763714101193285
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:2/98RuwaBssHux10zcMUuZfr/HzJ+qHYeLIIEgnKcgsScMMUnK9Y240pD:2/98sw8fqAvjr/TJ+qHvI2c3O
                                                                                                                                                              MD5:B8FFF5203C0258A806AABCDFE0BE2FCF
                                                                                                                                                              SHA1:110794813F5D909B77CF7A8A5FE70686D5E0715C
                                                                                                                                                              SHA-256:EAF53258B401FC59347FE74075A8F93155AB6F5C55C354446650EB7C77619B85
                                                                                                                                                              SHA-512:1E7CBB0D0385EB9C131EC4C0673483E81CF7BE7A788B9F8AC5010DEDCB872D798ADB898FCB91F5E0A0119A013F254DB7D36A025091E4267767883FFD7C8DEE50
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:d=nK$R..W7..ts.#...to......_...X_..Fcn.8.....i..t..2..8......t.....>...Z...7.{....\D...h8Q.u7,.K..T...n.9..A^.%l..%.....-m&..Gct...#.$.w..r~.R6R..0\sW..D3.....o.*...U.h..y;....Q....<......!J..........f..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\Favorites\Links\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\Favorites\Live.url.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):344
                                                                                                                                                              Entropy (8bit):7.368224721318688
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:Sx3Uq81LrgBq6D5RX7a7EgRgTuKcgsScMMUnK9Y240pD:6UJLrgBFDf6rXc3O
                                                                                                                                                              MD5:0C0C0785860380575642AF0EC2EC77D8
                                                                                                                                                              SHA1:D16F1CAA4621C763DCDBBD95BBF15DAE9DA8EA0E
                                                                                                                                                              SHA-256:F22475BF13C02A2662505C4F4F216E6E82F039690C13651B4715379227E602D9
                                                                                                                                                              SHA-512:E172343683EB71B1085D0E608F08616D8E86427D08616037FF6C3DBC13F13DC2991E5CF1CB1A132FFFCA9A6F3519F86BED554B60AC3B4D138300AF1C44707549
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:...g..&.H..[..qP.....9.(^...U.'.....';.F7b.cc..k..4...(!B..OG..,.m..!o4=.......8]..5..}...V...[>.`N9.i..a..9..2..L.....a;I.>y&...ct... .$.t....C..=..4v.@<.._..-...Fqq..Z4xa...L.g....K.....#5U=3E.D.G5..e..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\Favorites\NYTimes.url.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):353
                                                                                                                                                              Entropy (8bit):7.395749426982956
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:jBeqAS9eT1Qd0dYddSRZsa5DiFr1R9tLMmcgsScMMUnK9Y240pD:jg7lQ1OHN5OFrbPwY3O
                                                                                                                                                              MD5:B2F1A2413D2382AEE2B0A7E2071C2BA0
                                                                                                                                                              SHA1:1C1E96075A5D70D8254280CE63CFCEB9C4D94E34
                                                                                                                                                              SHA-256:502CB494504D716D78EDE45EA42633CC36D743AF5CB25DBC2B2543FE57196648
                                                                                                                                                              SHA-512:1A830341F3E51E5C958EC338A09F278BDF438063195E7DDE449A30EF61B3CB5EDA6044943F9597D6C6E6CD787A5B98BEA552144BC25DF20C11E424B65884A3B9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:/.3-.t.._.........g..O....B..CVFs....>.M.......v..Y!...]}P....x...0... ....z.}A.../..Ull....\,....~7...9...........`........zt..E .$.t..i..xt..,.)....,..kGF..tW....Z..^<.......0.......]...x...)...6Q.Ok..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\Favorites\Reddit.url.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):349
                                                                                                                                                              Entropy (8bit):7.371148045587366
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:Up4kly9kmSTwxX0sBCMtWvt3vUREEF55cgsScMMUnK9Y240pD:w4uyyx8xXrbWpvyjDX3O
                                                                                                                                                              MD5:9BB277DB445BC402E4C2BB8E3BF6587C
                                                                                                                                                              SHA1:2FF2DA84FF336FADFA9439A087368989971F1DDC
                                                                                                                                                              SHA-256:48ACFFAEFE596EFA3F556B4627F7012CD69FCECB3AB19D591D0B0595878E8F5B
                                                                                                                                                              SHA-512:EF37FFFF330E6316AA09608ACCD34459B002AF448D17E89A2E1CBBCBF7679CC62705861CD386C743B6535470EC4728507FCF8E57AEB376BA66F73E3519BE17BF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.`..X...(.J.|p6g.@..\~...w........@k.}....e.{U`?..O.Q.R&E*..-.~...R...`.{5.......%.....V..\nX......J0/ ....9.. .. l..%...'./y&...c&... .'.t..i........g,1..1.........<+u(.F....er.{{.Rg....1n...a2.d7:s.a...h..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\Favorites\Twitter.url.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):350
                                                                                                                                                              Entropy (8bit):7.335734264797327
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:UfKssxbZb7MbnZUv09YUhv4hbVScScgsScMMUnK9Y240pD:UKJZb8lN/3O
                                                                                                                                                              MD5:42F073C020815C92B0574B57467A1772
                                                                                                                                                              SHA1:0ED7FEFA38A70786288D7F30AAF92683DFBE426C
                                                                                                                                                              SHA-256:EF484B260B8D95F62FBF2233232ACC8781A9C7E16F1198F150560245C0316838
                                                                                                                                                              SHA-512:7EC8DBA8830BB7CA4EE4D4F0BB70650663035188C8496B4E928B9DDEE9C2A71AA0397D3FBCC73D42AB775C30D669A4B000EA824E7F91BC71860BB98BB8416940
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..Q.T..sQ...(.0...|.X..FUO.-.n......+....se....<@.Tay.7P...t.T........|...(9k_7..Te.?.'8D@;j...1fVP...:...o.F..9..-..g..y.....'..{&...c&... .'.t..i./<...b.xc..CXL...yypU..p.....5.'N....Z.....1.....0......%rh..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\Favorites\Wikipedia.url.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):356
                                                                                                                                                              Entropy (8bit):7.4062933776348
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:oPArgtGffXFIKH0ce/m9ma0SXGV5oeqtuy/DxcgsScMMUnK9Y240pD:oYrgAxUc9mHEXtusDf3O
                                                                                                                                                              MD5:42FFE577766C046419DB297ED72B3BC6
                                                                                                                                                              SHA1:5CE4558976C7640ED75B068510AFE0E2EF5D0740
                                                                                                                                                              SHA-256:78AB8EA5D896F01E762E4E374426637183DCC898380BB8FD0470FC09A729566D
                                                                                                                                                              SHA-512:C8A6CEE4155059CDC0FEC33ACD543E9C9B81F0E0299DBA164C68C6FFD95E3C8F76E02422D3CC39E279B0CE99ADCD2DC2383E631CAC32CD40AE58A19A981A428F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.~...i%r'...P6rOEHYt..!.a....u.;{...cqni...ov..U.O5u0.ZX8P.....`$}V....-+..c.."Q^..~..qz..HQ..u.......4...V...9../..9l..o.,.k>._.J...cn...r.$.t..i..xt....O*..G.[.....].H .iX$.M..(f.;+s.5#_..p..e....((d/...Z.H..@.l..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\Favorites\Youtube.url.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):350
                                                                                                                                                              Entropy (8bit):7.332709550437432
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:Kd3M8NEABpGXQ/oFwO4j43eyjiNvDMsszZbbyzcgsScMMUnK9Y240pD:0cG7pRhI+8FS3O
                                                                                                                                                              MD5:C162B82070D5FACC66775C49B3552870
                                                                                                                                                              SHA1:FCE4C183EDA442EBC91471A88AE32E6F72022F36
                                                                                                                                                              SHA-256:F50675E2B8B4A03C1DDB39E0478EB4BA034A8090D30DF9A8DDF2581BEDBD5A51
                                                                                                                                                              SHA-512:230E92ED9B442B271177E41861B35BEE0E4855F040EE20B66BBF509F4779ACED09F483882F340CC156E0627D44CC1BFC4AD4FA348860502A729FD6F2430C4569
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:Af+..-..4...R..>"H.?r.QPn...h.+($.c.Y&.....cu.B.H..u..(..zG.D0A.].y....._.3........2>Q..B....].`.5.mb...M}\v.9..1..k..n....k'..{&...c&... .'.t..i...,..O...c.t..H.E...k..1...T6...p...D.I..n...........3r......h..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\Favorites\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\Links\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\Music\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\OneDrive\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\Pictures\Camera Roll\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\Pictures\Saved Pictures\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\Pictures\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\Recent\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\Saved Games\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\Searches\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1002}-.searchconnector-ms.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1174
                                                                                                                                                              Entropy (8bit):7.822944189805734
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:24y5vBYz/Egvzi3lXFK00iuI3o5AK2FDgh0PN3TZf1Mnl+wCjbpNY+:9y5yzL2h8NiuUooy0FjTI03bpNY+
                                                                                                                                                              MD5:BB8CC3B332E520A8B167775689B91390
                                                                                                                                                              SHA1:409D0855A0931ECAF68B842099CBF1EE9FB682FC
                                                                                                                                                              SHA-256:A377573EE85E12F4ECD90EF4F315549EF6F97FC7B890A43063FF0AFFFE2B84CC
                                                                                                                                                              SHA-512:B30DF9758D6992E7F8FA1D0C7CBADF843EFD64C7DB8612DD7C4E7D8CEF0576300506B41F562D2492AD786D1E9FF38F167B72E8A8FB98E9D12CF6391201F06D69
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:6..H.%.1..2.....+..f..t=Yr...../N./JQ].;9...."]....).Ix...;..E........+Eq..zd..'.1..M....X....F%k.......aG.T.y..E.F.....d.......7.......0...O....!......&,8..G.`l#.l..q)...a....t..F.....~lXXU..$.5n6-..`.!J..o.sc:...8d..@..qeh.Q.4b..b.7......._\}.:f...}>.Z...O7.....+.~g=Ph..<62.c.(.'d....g..lo..(\...vVF.*.B8..<....vz...V8[.a....L....A...p.......q0...|..~..^.8.0.W.JbV3.@.m..2......V-...g..c..I..e..4....N.Rh.x9...WE6.@yEWT.| .\.7X.I...G..~.Gf.h..v.}..`.'~.P.#%.^r1./..~......Z.V....?I@]7...#...e.`!`~B.s...m.n...9K..........z.R-YF. =?oz3........rV.N.....D8..4......WV.0[....|v...1.=. .....|...d...f..B@.....+.dRZ.'..Nl.(...`.j.+...?.....i)..... .....^....JY;0...4.H..x.f..4.......$...\a...@...p......q*.'...4.'.....PG....V.I.5..,qV.Pg.A"> .0.!...o~Y.6c.^i"Q..q...mo..}Y ..u..k..)....E..;..:...#.<A."..P.e/R..=.....e=9..*.........z'$L./.c.q..!8..dA.i.Z.y.y.R..4.......gn.n.4hDu..E....).=.?8...E...........l..xN..D..d?..g.K.[p./....8@....!B..R/..

                                                                                                                                                              C:\Users\user\Videos\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Users\user\_curlrc.jC7CNxlVt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):239
                                                                                                                                                              Entropy (8bit):7.162086786933536
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:v+6dEBy4pRAG0quMO3ctHJgJ+YgcgsScMMUnK9Y240pD:vFdmrpx0qeS3O
                                                                                                                                                              MD5:E050161C23251D9E08A1FC1BBE315CFE
                                                                                                                                                              SHA1:690FA825D9404AB60B256FE7D197A8E6814FD4CB
                                                                                                                                                              SHA-256:49CF4BD34D9AE51B8C2A2B8E4618F5B044EDE01B8C82107B90F170299B7347F6
                                                                                                                                                              SHA-512:15DD5484EBE1674CE73C7F56886D11810CE6346DC482DCAA8F0E4197A3E19A5FAC4E2E4603871147A8AE9691AF5DFE12951B3DF19B2E7CF2E22CEBE31DC811CB
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........9..1..........K..y&...`t... .$....O......,V.E..3..9...........#..in.3\<....'..Hb.v..[b....$a..X.........wH.dt.d..M...X..#l..v1w(.....1...Us.h.;y. ...I..D.yU-M.Ns.g.h.^..=.qw`./.B.Y..q..s.i.....1.Y=....-};..o...n..rk..\..:.\

                                                                                                                                                              C:\Users\user\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              C:\Windows\System32\spool\PRINTERS\00002.SPL

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\splwow64.exe
                                                                                                                                                              File Type:Microsoft OOXML
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):13754285
                                                                                                                                                              Entropy (8bit):7.893000182545878
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:196608:fRmySp2JVWzk7Q7LBIUEqiodDe+xjCmcn6EZLnxdG7XzAkbY0TSeInzeEtuirF6n:f8eb697bEOQaFZaJBM
                                                                                                                                                              MD5:FB2A084C7827E647DAF064975DEC4F3D
                                                                                                                                                              SHA1:FE5CDE6BE4052D0CA8F6D453C078F90013770743
                                                                                                                                                              SHA-256:BBCD9BAC8276AFDAB4C48B2D59079C1789563FB372A6BA877F3CF1001541EAF1
                                                                                                                                                              SHA-512:B0B581C7FA8286091867CA30423E0334850C62F68E6472607C0FA2B69CC5BB2A2536CBC5C947749F951022D4ABE27AB31D8020989E8D5674BAB405DC26DB7E4E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:PK.........K.X................[Content_Types].xml/[0].piece.....0..W..o.x .....e.(....Ql!..<...S^.MMw....#Nr.9....p..:..J.z..`3..DM....T.n..J..-c...3....&a#......PK....X.j...q...PK.........K.X................[Content_Types].xml/[1].piece..1..0....eE$....{e.C.&..X.........H\., .....o.T..i.."...K.s..4..VW...i+.Ak.....}....\.+..O?PK..K..jb...l...PK.........K.X................_rels/.rels/[0].pieceM.A..!.E.B.w...1.....9@...C!...?,].......f..4.qp.,.._^I...y?\`.....Cc.jF". .^...#g.T.A.e.c.........3.....PK...BpJl...y...PK.........K.X................_rels/.rels/[1].piece..K..0....9@&.....nk/.....O3S...s....L/'.UN...'.......P....UO:....=X......B..gD...c]...[..[..3..9.9a.... .....N.PK..4...u.......PK.........K.X................[Content_Types].xml/[2].piece-.A.. .F....p.u.q.&....!...m..[.n_^..kA.......>|.......f....`........}..F..(v.6.t...0-.n.C|@.N-.Z...PK....[Pm...{...PK.........K.X............%...FixedDocumentSequence.fdseq/[0].pieceU.M..0.F..fo&.....H.`..2.....H.o..p

                                                                                                                                                              C:\jC7CNxlVt.README.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):434
                                                                                                                                                              Entropy (8bit):5.294462083814933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:bGgfZUqbl8ZTOhg+0ED0nNErJgwiLaOh7J:bG0yq6ZTOhg+2EVRiNJ
                                                                                                                                                              MD5:AD29BD8C66E114FF57C943D16C78F72A
                                                                                                                                                              SHA1:5AB070EE89A36F38FACAE4DFC8EC5CE3E59AF46E
                                                                                                                                                              SHA-256:6FE668FE8BF69158D1FD08E90F3CFF60C1DF410BF752635BF152853B6112549C
                                                                                                                                                              SHA-512:A53121E2379AA9C3BC52D073498A54F26383834F6D6636B4B3831010565C80BF0DA07511907EAB7BD92F9796E559958B1C0EBEA4C4B0F0D869E95B7DEB5DA7F1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....!! ALL YOUR FILES ARE ENCRYPTED !!!..........You can't restore them without our decryptor...........Don't try to use any public tools, you could damage the files and lose them forever...........To make sure our decryptor works, contact us and decrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                                                                                                                                                              \Device\Null

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):22
                                                                                                                                                              Entropy (8bit):4.186704345910024
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:otlXoov:ot+ov
                                                                                                                                                              MD5:A590DA831909370329BCD170F3428AB3
                                                                                                                                                              SHA1:9008557084249ED914B5D5BFFA325CDE05E07D83
                                                                                                                                                              SHA-256:ABB634AB5497D4FBC4AC0ECDC8980373E99212FDDFBE36DA8151C60F66CC0C66
                                                                                                                                                              SHA-512:E77EF75DED079BC46D61B680B9FF68E7BC158B5A39C6BC27FDAB550D379424E571D0357ED0608A750BD25E39F5C3FA7AB6EA5128E5CF0B73FC5EAC889D180973
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:C:\PROGRA~3\D448.tmp..

                                                                                                                                                              Static File Info

                                                                                                                                                              General

                                                                                                                                                              File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Entropy (8bit):6.773638151073258
                                                                                                                                                              TrID:
                                                                                                                                                              • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                              • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                              • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                              File name:Document.doc.scr.exe
                                                                                                                                                              File size:199'168 bytes
                                                                                                                                                              MD5:407ea767aa26ae13f9ff20d0999c8dda
                                                                                                                                                              SHA1:07e615132ef78e827047ffc4cc6c9d44f5a976fd
                                                                                                                                                              SHA256:f2198deecddd5ae56620b594b6b20bf8a20f9c983d4c60144bc6007a53087ce4
                                                                                                                                                              SHA512:6c14d07b497af375f2f4db4da321ed7e5fb60a6f26281bcdbfc513eb1033d98442ff83ee58849a721bd7e14a0b7094b98397923c35bd4b6ae91c179784de6b02
                                                                                                                                                              SSDEEP:3072:L6glyuxE4GsUPnliByocWepVeKna4iJ0Cv+LmaGqsqRxB:L6gDBGpvEByocWePk4iJ0C2LYcx
                                                                                                                                                              TLSH:AC145B20F251A8B3C42724F52A32E571739A9F2D1D6C180FEAB53F0A6CB65D32B15D4B
                                                                                                                                                              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...e..c............................o.............@..........................P.......f....@...........@....................

                                                                                                                                                              File Icon

                                                                                                                                                              Icon Hash:76d393391a9ba6ba

                                                                                                                                                              Static PE Info

                                                                                                                                                              General

                                                                                                                                                              Entrypoint:0x41946f
                                                                                                                                                              Entrypoint Section:.itext
                                                                                                                                                              Digitally signed:false
                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                              Subsystem:windows gui
                                                                                                                                                              Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                                                                              DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                                                                                                                              Time Stamp:0x631A9665 [Fri Sep 9 01:27:01 2022 UTC]
                                                                                                                                                              TLS Callbacks:
                                                                                                                                                              CLR (.Net) Version:
                                                                                                                                                              OS Version Major:5
                                                                                                                                                              OS Version Minor:1
                                                                                                                                                              File Version Major:5
                                                                                                                                                              File Version Minor:1
                                                                                                                                                              Subsystem Version Major:5
                                                                                                                                                              Subsystem Version Minor:1
                                                                                                                                                              Import Hash:41fb8cb2943df6de998b35a9d28668e8

                                                                                                                                                              Entrypoint Preview

                                                                                                                                                              Instruction
                                                                                                                                                              nop
                                                                                                                                                              nop word ptr [eax+eax+00000000h]
                                                                                                                                                              call 00007FC2BCE6ECD7h
                                                                                                                                                              nop dword ptr [eax+00h]
                                                                                                                                                              call 00007FC2BCE5C06Ah
                                                                                                                                                              nop
                                                                                                                                                              call 00007FC2BCE5F657h
                                                                                                                                                              nop dword ptr [eax+00h]
                                                                                                                                                              call 00007FC2BCE6D116h
                                                                                                                                                              nop word ptr [eax+eax+00h]
                                                                                                                                                              push 00000000h
                                                                                                                                                              call dword ptr [004255C8h]
                                                                                                                                                              nop word ptr [eax+eax+00000000h]
                                                                                                                                                              call 00007FC2BCE6EA76h
                                                                                                                                                              call 00007FC2BCE6EA65h
                                                                                                                                                              call 00007FC2BCE6EA54h
                                                                                                                                                              call 00007FC2BCE6EA61h
                                                                                                                                                              call 00007FC2BCE6EA4Ah
                                                                                                                                                              call 00007FC2BCE6EA45h
                                                                                                                                                              call 00007FC2BCE6EA46h
                                                                                                                                                              call 00007FC2BCE6EA5Fh
                                                                                                                                                              call 00007FC2BCE6EA54h
                                                                                                                                                              call 00007FC2BCE6EA1Fh
                                                                                                                                                              call 00007FC2BCE6E9FCh
                                                                                                                                                              call 00007FC2BCE6EA09h
                                                                                                                                                              call 00007FC2BCE6E9F8h
                                                                                                                                                              call 00007FC2BCE6EA11h
                                                                                                                                                              call 00007FC2BCE6EA12h
                                                                                                                                                              call 00007FC2BCE6E9FBh
                                                                                                                                                              call 00007FC2BCE6E9EAh
                                                                                                                                                              call 00007FC2BCE6E9CDh
                                                                                                                                                              call 00007FC2BCE6E9C8h
                                                                                                                                                              call 00007FC2BCE6E9E7h
                                                                                                                                                              call 00007FC2BCE6E9CAh
                                                                                                                                                              call 00007FC2BCE6E9B3h
                                                                                                                                                              call 00007FC2BCE6E9BAh
                                                                                                                                                              call 00007FC2BCE6D545h
                                                                                                                                                              call 00007FC2BCE6D54Ch
                                                                                                                                                              call 00007FC2BCE6D529h
                                                                                                                                                              call 00007FC2BCE6D530h

                                                                                                                                                              Data Directories

                                                                                                                                                              NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_IMPORT0x1a2300x50.rdata
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0x270000xc160.rsrc
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x340000xfd0.reloc
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_DEBUG0x1a1200x1c.rdata
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_IAT0x1a0000x70.rdata
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                              Sections

                                                                                                                                                              NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                              .text0x10000x17de80x17e00cfbda2c44e51b3b0b00bcbbc767c62a2False0.48375122709424084data6.634079266913224IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                              .itext0x190000x5460x6006f4cd57381bb5584c0a0755384d25180False0.251953125data2.9337361310958805IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                              .rdata0x1a0000x4920x600bd829aa493ecd52fe5bec776d207f206False0.3671875data3.5366359784052652IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                              .data0x1b0000xadc80xa000946dc0ed16a69bcd5d8b2e54d7816d73False0.9826416015625SysEx File -7.9882343419366055IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                              .pdata0x260000x88f0xa0001e60c1569b6b7196ce1bbe9507a1fcfFalse0.88046875data7.326988333068622IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                              .rsrc0x270000xc1600xc2000498258b0cc68156e1295f5d17bb63e6False0.22473018685567012data4.478609900548174IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                              .reloc0x340000xfd00x10003f87e4c23650dfad0bee7da98889ba94False0.843505859375GLS_BINARY_LSB_FIRST6.738987246879603IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                              Resources

                                                                                                                                                              NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                              RT_ICON0x271f00x176dPNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9296314824078706
                                                                                                                                                              RT_ICON0x289600x4228Device independent bitmap graphic, 64 x 128 x 32, image size 00.0973665564478035
                                                                                                                                                              RT_ICON0x2cb880x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 00.13340248962655601
                                                                                                                                                              RT_ICON0x2f1300x1a68Device independent bitmap graphic, 40 x 80 x 32, image size 00.16715976331360946
                                                                                                                                                              RT_ICON0x30b980x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 00.20309568480300189
                                                                                                                                                              RT_ICON0x31c400x988Device independent bitmap graphic, 24 x 48 x 32, image size 00.2721311475409836
                                                                                                                                                              RT_ICON0x325c80x6b8Device independent bitmap graphic, 20 x 40 x 32, image size 00.34244186046511627
                                                                                                                                                              RT_ICON0x32c800x468Device independent bitmap graphic, 16 x 32 x 32, image size 00.41932624113475175
                                                                                                                                                              RT_GROUP_ICON0x330e80x76data0.7457627118644068

                                                                                                                                                              Imports

                                                                                                                                                              DLLImport
                                                                                                                                                              gdi32.dllSetPixel, SetDCBrushColor, SelectPalette, GetTextColor, GetDeviceCaps, CreateSolidBrush
                                                                                                                                                              USER32.dllDefWindowProcW, CreateMenu, EndDialog, GetDlgItem, GetKeyNameTextW, GetMessageW, GetWindowTextW, IsDlgButtonChecked, LoadImageW, LoadMenuW, DialogBoxParamW
                                                                                                                                                              KERNEL32.dllSetLastError, LoadLibraryW, GetTickCount, GetLastError, GetCommandLineW, GetCommandLineA, FreeLibrary

                                                                                                                                                              Network Behavior

                                                                                                                                                              ⊘No network behavior found

                                                                                                                                                              Statistics

                                                                                                                                                              CPU Usage

                                                                                                                                                              Click to jump to process

                                                                                                                                                              Memory Usage

                                                                                                                                                              Click to jump to process

                                                                                                                                                              High Level Behavior Distribution

                                                                                                                                                              Click to dive into process behavior distribution

                                                                                                                                                              Behavior

                                                                                                                                                              Click to jump to process

                                                                                                                                                              System Behavior

                                                                                                                                                              General

                                                                                                                                                              Target ID:0
                                                                                                                                                              Start time:09:15:50
                                                                                                                                                              Start date:26/04/2024
                                                                                                                                                              Path:C:\Users\user\Desktop\Document.doc.scr.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:"C:\Users\user\Desktop\Document.doc.scr.exe"
                                                                                                                                                              Imagebase:0xbe0000
                                                                                                                                                              File size:199'168 bytes
                                                                                                                                                              MD5 hash:407EA767AA26AE13F9FF20D0999C8DDA
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Yara matches:
                                                                                                                                                              • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: Windows_Ransomware_Lockbit_369e1e94, Description: unknown, Source: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Author: unknown
                                                                                                                                                              • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.2091177762.00000000013F1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000000.1618448431.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: Windows_Ransomware_Lockbit_369e1e94, Description: unknown, Source: 00000000.00000000.1618448431.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Author: unknown
                                                                                                                                                              • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000002.2101878302.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:5
                                                                                                                                                              Start time:09:16:28
                                                                                                                                                              Start date:26/04/2024
                                                                                                                                                              Path:C:\Windows\splwow64.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:C:\Windows\splwow64.exe 12288
                                                                                                                                                              Imagebase:0x7ff69c410000
                                                                                                                                                              File size:163'840 bytes
                                                                                                                                                              MD5 hash:77DE7761B037061C7C112FD3C5B91E73
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:moderate
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:8
                                                                                                                                                              Start time:09:16:38
                                                                                                                                                              Start date:26/04/2024
                                                                                                                                                              Path:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:/insertdoc "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\{E6830A1B-81EB-4C98-A5C6-BA0FB0C332A2}.xps" 133585893886890000
                                                                                                                                                              Imagebase:0xd20000
                                                                                                                                                              File size:2'191'768 bytes
                                                                                                                                                              MD5 hash:0061760D72416BCF5F2D9FA6564F0BEA
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:moderate
                                                                                                                                                              Has exited:false

                                                                                                                                                              General

                                                                                                                                                              Target ID:9
                                                                                                                                                              Start time:09:16:38
                                                                                                                                                              Start date:26/04/2024
                                                                                                                                                              Path:C:\ProgramData\D448.tmp
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:"C:\ProgramData\D448.tmp"
                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                              File size:14'336 bytes
                                                                                                                                                              MD5 hash:294E9F64CB1642DD89229FFF0592856B
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:moderate
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:10
                                                                                                                                                              Start time:09:16:39
                                                                                                                                                              Start date:26/04/2024
                                                                                                                                                              Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D448.tmp >> NUL
                                                                                                                                                              Imagebase:0x240000
                                                                                                                                                              File size:236'544 bytes
                                                                                                                                                              MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:high
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:11
                                                                                                                                                              Start time:09:16:39
                                                                                                                                                              Start date:26/04/2024
                                                                                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                              Imagebase:0x7ff7699e0000
                                                                                                                                                              File size:862'208 bytes
                                                                                                                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:high
                                                                                                                                                              Has exited:true

                                                                                                                                                              Disassembly

                                                                                                                                                              Reset < >

                                                                                                                                                                Execution Graph

                                                                                                                                                                Execution Coverage:22%
                                                                                                                                                                Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                Signature Coverage:16.4%
                                                                                                                                                                Total number of Nodes:1983
                                                                                                                                                                Total number of Limit Nodes:12
                                                                                                                                                                execution_graph 11384 bef032 11398 beeffb 11384->11398 11385 beefe7 MoveFileExW 11391 beeff9 11385->11391 11385->11398 11386 bef034 11389 be686c RtlFreeHeap 11386->11389 11387 be686c RtlFreeHeap 11387->11398 11388 bef051 CreateFileW 11390 bef07a 11388->11390 11402 bef075 11388->11402 11389->11391 11397 beed30 2 API calls 11390->11397 11391->11388 11391->11402 11392 bef14d 11393 be686c RtlFreeHeap 11392->11393 11396 bef155 11393->11396 11394 beece4 RtlAllocateHeap 11394->11398 11395 be686c RtlFreeHeap 11395->11392 11399 bef08f 11397->11399 11398->11385 11398->11386 11398->11387 11398->11391 11398->11394 11400 bef0a3 CreateIoCompletionPort 11399->11400 11399->11402 11401 bef0ba 11400->11401 11404 bef0dc 11400->11404 11403 be686c RtlFreeHeap 11401->11403 11402->11392 11402->11395 11403->11402 11404->11402 11405 be686c RtlFreeHeap 11404->11405 11405->11402 11585 beddf2 11588 beddde 11585->11588 11586 beddf0 11587 bede3d 11586->11587 11589 be686c RtlFreeHeap 11586->11589 11588->11586 11590 bedb90 NtTerminateProcess 11588->11590 11591 bedc60 NtTerminateProcess 11588->11591 11589->11587 11590->11588 11591->11588 11348 bef8f0 11350 bef8d2 11348->11350 11349 be6844 RtlAllocateHeap 11349->11350 11350->11349 11352 bef8ee 11350->11352 11351 befa12 11352->11351 11353 be6844 RtlAllocateHeap 11352->11353 11353->11352 11406 bee430 11409 bee3f3 11406->11409 11407 bee3c5 SetFileAttributesW CreateFileW 11407->11409 11410 bee40b 11407->11410 11408 bede48 5 API calls 11408->11409 11409->11407 11409->11408 11409->11410 11453 bf4070 11458 bf40b4 11453->11458 11454 bf44e2 11456 bf44f0 11454->11456 11457 be686c RtlFreeHeap 11454->11457 11455 be686c RtlFreeHeap 11455->11454 11459 bf44fe 11456->11459 11460 be686c RtlFreeHeap 11456->11460 11457->11456 11461 be6de8 RtlAllocateHeap 11458->11461 11464 bf40d2 11458->11464 11460->11459 11462 bf4186 11461->11462 11463 be6844 RtlAllocateHeap 11462->11463 11462->11464 11463->11464 11464->11454 11464->11455 9282 bf946f 9283 bf947e 9282->9283 9290 be639c 9283->9290 9287 bf948e 9386 bf7458 9287->9386 9431 be5aec 9290->9431 9293 be654d 9341 be9990 9293->9341 9294 be63b6 RtlCreateHeap 9294->9293 9295 be63d1 9294->9295 9296 be5aec 3 API calls 9295->9296 9297 be63ed 9296->9297 9297->9293 9439 be5da0 9297->9439 9300 be5da0 8 API calls 9301 be6419 9300->9301 9302 be5da0 8 API calls 9301->9302 9303 be642a 9302->9303 9304 be5da0 8 API calls 9303->9304 9305 be643b 9304->9305 9306 be5da0 8 API calls 9305->9306 9307 be644c 9306->9307 9308 be5da0 8 API calls 9307->9308 9309 be645d 9308->9309 9310 be5da0 8 API calls 9309->9310 9311 be646e 9310->9311 9312 be5da0 8 API calls 9311->9312 9313 be647f 9312->9313 9314 be5da0 8 API calls 9313->9314 9315 be6490 9314->9315 9316 be5da0 8 API calls 9315->9316 9317 be64a1 9316->9317 9318 be5da0 8 API calls 9317->9318 9319 be64b2 9318->9319 9320 be5da0 8 API calls 9319->9320 9321 be64c3 9320->9321 9322 be5da0 8 API calls 9321->9322 9323 be64d4 9322->9323 9324 be5da0 8 API calls 9323->9324 9325 be64e5 9324->9325 9326 be5da0 8 API calls 9325->9326 9327 be64f6 9326->9327 9328 be5da0 8 API calls 9327->9328 9329 be6507 9328->9329 9330 be5da0 8 API calls 9329->9330 9331 be6518 9330->9331 9332 be5da0 8 API calls 9331->9332 9333 be6529 9332->9333 9334 be5da0 8 API calls 9333->9334 9335 be653a 9334->9335 9445 beb444 9335->9445 9337 be6541 9448 bf7738 9337->9448 9342 be9995 9341->9342 9495 be6f48 9342->9495 9344 be999a 9528 beb4dc CheckTokenMembership 9344->9528 9346 be99d7 9529 be6d40 9346->9529 9348 be99e6 9350 be99f4 9348->9350 9532 bebb70 9348->9532 9349 be99b9 9349->9346 9590 beb4fc 9349->9590 9350->9287 9354 be9a00 9535 beb708 9354->9535 9362 be9a9f 9366 be9ade 9362->9366 9371 beb674 NtQueryInformationToken 9362->9371 9363 be9a13 9363->9362 9548 beb1ac 9363->9548 9562 bec3f8 9366->9562 9367 be9a3c 9367->9363 9603 beae74 9367->9603 9379 be9acc 9371->9379 9378 be9a7a 9378->9362 9381 be686c RtlFreeHeap 9378->9381 9379->9366 9627 bf31e8 9379->9627 9382 be9a89 9381->9382 9383 be686c RtlFreeHeap 9382->9383 9384 be9a94 9383->9384 9385 be686c RtlFreeHeap 9384->9385 9385->9362 9387 bf7482 9386->9387 9388 bf7498 31 API calls 9387->9388 9389 bf74a3 9387->9389 9399 bf74b2 9387->9399 9690 be9bb0 9389->9690 9393 bf7624 9759 bf205c 9393->9759 9394 bf7631 9396 bf7637 9394->9396 9397 bf7646 9394->9397 9398 be9bb0 14 API calls 9396->9398 9400 bf764c 9397->9400 9401 bf7656 9397->9401 9402 bf763c 9398->9402 9399->9393 9399->9394 9843 bf73ac 9400->9843 9404 bf765c 9401->9404 9405 bf7675 9401->9405 9810 bf1ef4 9402->9810 9854 bf6fa0 9404->9854 9406 bf767b 9405->9406 9407 bf7685 9405->9407 9881 bf390c 9406->9881 9412 bf768b 9407->9412 9413 bf76d8 9407->9413 9417 bf76ba 9412->9417 9888 bf6da8 9412->9888 9415 bf76de 9413->9415 9416 bf76e7 9413->9416 9418 bf6bbc 2 API calls 9415->9418 9933 bea338 9416->9933 9417->9388 9902 bf04b4 9417->9902 9418->9388 9423 bf771c 9937 bf2428 9423->9937 9425 bea338 2 API calls 9426 bf770b 9425->9426 9426->9423 9427 bf7710 9426->9427 9428 be9bb0 14 API calls 9427->9428 9429 bf7715 9428->9429 9430 bf7034 138 API calls 9429->9430 9430->9388 9432 be5afe 9431->9432 9434 be5b18 9431->9434 9433 be5aec 3 API calls 9432->9433 9433->9434 9435 be5aec 3 API calls 9434->9435 9437 be5b40 9434->9437 9435->9437 9436 be5c0a 9436->9293 9436->9294 9437->9436 9459 be5a84 9437->9459 9474 be5c24 9439->9474 9441 be5dcb 9441->9300 9442 be5aec 3 API calls 9443 be5ddb RtlAllocateHeap 9442->9443 9444 be5db5 9443->9444 9444->9441 9444->9442 9446 beb458 NtSetInformationThread 9445->9446 9446->9337 9449 bf7754 9448->9449 9489 be6844 9449->9489 9451 bf7764 9452 be6548 9451->9452 9492 be686c 9451->9492 9454 beb470 9452->9454 9455 be5aec 3 API calls 9454->9455 9456 beb495 9455->9456 9457 beb49e NtProtectVirtualMemory 9456->9457 9458 beb4bb 9456->9458 9457->9458 9458->9293 9460 be5ae2 9459->9460 9461 be5ab0 9459->9461 9460->9437 9461->9460 9466 be5a20 9461->9466 9463 be5ac4 9463->9460 9464 be5ad8 9463->9464 9469 be59d4 9464->9469 9467 be5a37 9466->9467 9468 be5a65 LdrLoadDll 9467->9468 9468->9463 9470 be5a04 LdrGetProcedureAddress 9469->9470 9471 be59e3 9469->9471 9472 be5a16 9470->9472 9473 be59ef LdrGetProcedureAddress 9471->9473 9472->9460 9473->9472 9475 be5c51 9474->9475 9476 be5c37 9474->9476 9478 be5c79 9475->9478 9479 be5aec 3 API calls 9475->9479 9477 be5aec 3 API calls 9476->9477 9477->9475 9480 be5ca1 9478->9480 9481 be5aec 3 API calls 9478->9481 9479->9478 9482 be5ce9 FindFirstFileW 9480->9482 9483 be5d5a 9480->9483 9484 be5d19 FindClose 9480->9484 9485 be5d37 FindNextFileW 9480->9485 9481->9480 9482->9480 9483->9444 9486 be5a20 LdrLoadDll 9484->9486 9485->9480 9487 be5d4b FindClose 9485->9487 9488 be5d30 9486->9488 9487->9480 9488->9444 9490 be684c 9489->9490 9491 be685a RtlAllocateHeap 9490->9491 9491->9451 9493 be6874 9492->9493 9494 be6882 RtlFreeHeap 9493->9494 9494->9452 9631 be6de8 9495->9631 9497 be6f60 9498 be7237 9497->9498 9499 be6844 RtlAllocateHeap 9497->9499 9498->9344 9503 be6f7d 9499->9503 9500 be722f 9501 be686c RtlFreeHeap 9500->9501 9501->9498 9502 be686c RtlFreeHeap 9502->9500 9503->9500 9504 be6844 RtlAllocateHeap 9503->9504 9505 be7000 9503->9505 9527 be7221 9503->9527 9504->9505 9506 be7033 9505->9506 9507 be6844 RtlAllocateHeap 9505->9507 9508 be6844 RtlAllocateHeap 9506->9508 9509 be7066 9506->9509 9507->9506 9508->9509 9511 be7099 9509->9511 9513 be6844 RtlAllocateHeap 9509->9513 9510 be70ff 9516 be6844 RtlAllocateHeap 9510->9516 9517 be7132 9510->9517 9512 be70cc 9511->9512 9514 be6844 RtlAllocateHeap 9511->9514 9512->9510 9515 be6844 RtlAllocateHeap 9512->9515 9513->9511 9514->9512 9515->9510 9516->9517 9518 be6844 RtlAllocateHeap 9517->9518 9520 be7169 9517->9520 9518->9520 9519 be6844 RtlAllocateHeap 9521 be71a4 9519->9521 9520->9519 9520->9527 9521->9527 9634 be6ee4 9521->9634 9523 be71cc 9524 be6844 RtlAllocateHeap 9523->9524 9525 be71eb 9524->9525 9526 be686c RtlFreeHeap 9525->9526 9525->9527 9526->9527 9527->9502 9528->9349 9530 be6844 RtlAllocateHeap 9529->9530 9531 be6d55 9530->9531 9531->9348 9533 be6844 RtlAllocateHeap 9532->9533 9534 bebb81 9533->9534 9534->9354 9536 beb715 9535->9536 9537 beb71c RtlAdjustPrivilege 9536->9537 9538 be9a0a 9536->9538 9537->9536 9537->9538 9539 beb674 9538->9539 9540 beb68b 9539->9540 9541 beb68f NtQueryInformationToken 9540->9541 9542 be9a0f 9540->9542 9541->9542 9542->9363 9543 beb388 9542->9543 9643 be97d8 9543->9643 9545 beb3a5 9546 be9a29 9545->9546 9653 be9880 9545->9653 9546->9363 9602 beb4dc CheckTokenMembership 9546->9602 9549 beb1ca 9548->9549 9550 be6844 RtlAllocateHeap 9549->9550 9552 beb1d5 9550->9552 9551 be9a58 9551->9362 9620 beb5b8 9551->9620 9552->9551 9553 be686c RtlFreeHeap 9552->9553 9556 beb1f6 9553->9556 9554 beb350 9555 be686c RtlFreeHeap 9554->9555 9555->9551 9556->9554 9660 be6e18 9556->9660 9558 beb306 9559 be6e18 RtlAllocateHeap 9558->9559 9560 beb32b 9559->9560 9561 be6e18 RtlAllocateHeap 9560->9561 9561->9554 9563 be9af3 9562->9563 9564 bec418 9562->9564 9584 bee2b8 9563->9584 9565 be6de8 RtlAllocateHeap 9564->9565 9566 bec429 9565->9566 9566->9563 9567 be6844 RtlAllocateHeap 9566->9567 9572 bec445 9567->9572 9568 bec645 9569 be686c RtlFreeHeap 9568->9569 9569->9563 9570 bec636 9571 be686c RtlFreeHeap 9570->9571 9571->9568 9572->9568 9572->9570 9573 bec499 CreateFileW 9572->9573 9573->9570 9574 bec4ed WriteFile 9573->9574 9574->9570 9575 bec508 RegCreateKeyExW 9574->9575 9575->9570 9576 bec531 RegSetValueExW 9575->9576 9578 bec62d NtClose 9576->9578 9579 bec563 RegCreateKeyExW 9576->9579 9578->9570 9579->9578 9581 bec5de RegSetValueExW 9579->9581 9581->9578 9583 bec612 SHChangeNotify 9581->9583 9583->9578 9585 bee2d4 9584->9585 9663 bee350 9585->9663 9587 bee32a 9588 be9af8 9587->9588 9589 be686c RtlFreeHeap 9587->9589 9588->9287 9589->9588 9592 beb511 9590->9592 9591 be99ce 9591->9346 9596 bebabc 9591->9596 9592->9591 9593 be6844 RtlAllocateHeap 9592->9593 9595 beb54a 9593->9595 9594 be686c RtlFreeHeap 9594->9591 9595->9591 9595->9594 9598 bebad1 9596->9598 9597 bebb66 9597->9346 9598->9597 9667 be9740 9598->9667 9601 be686c RtlFreeHeap 9601->9597 9602->9367 9604 beaebf 9603->9604 9619 beb074 9604->9619 9671 beac28 9604->9671 9606 beaecd 9607 beb0cf 9606->9607 9608 beafbb 9606->9608 9606->9619 9609 be6de8 RtlAllocateHeap 9607->9609 9607->9619 9610 be6de8 RtlAllocateHeap 9608->9610 9608->9619 9611 beb0fe 9609->9611 9612 beafee 9610->9612 9613 be686c RtlFreeHeap 9611->9613 9611->9619 9614 be686c RtlFreeHeap 9612->9614 9612->9619 9613->9619 9615 beb010 9614->9615 9616 be6de8 RtlAllocateHeap 9615->9616 9615->9619 9617 beb056 9616->9617 9618 be686c RtlFreeHeap 9617->9618 9617->9619 9618->9619 9619->9363 9621 beb5cd 9620->9621 9622 be6844 RtlAllocateHeap 9621->9622 9623 be9a71 9621->9623 9624 beb606 9622->9624 9623->9362 9626 beb4dc CheckTokenMembership 9623->9626 9624->9623 9625 be686c RtlFreeHeap 9624->9625 9625->9623 9626->9378 9628 bf31f8 9627->9628 9630 bf3256 9628->9630 9680 bf2f58 9628->9680 9630->9366 9632 be6844 RtlAllocateHeap 9631->9632 9633 be6df9 9632->9633 9633->9497 9635 be6f0b 9634->9635 9640 be6e8c 9635->9640 9637 be6f2b 9638 be686c RtlFreeHeap 9637->9638 9639 be6f3f 9638->9639 9639->9523 9641 be6844 RtlAllocateHeap 9640->9641 9642 be6eaf 9641->9642 9642->9637 9644 be6844 RtlAllocateHeap 9643->9644 9647 be97f6 9644->9647 9645 be97f9 NtQuerySystemInformation 9645->9647 9650 be980f 9645->9650 9646 be982c 9649 be686c RtlFreeHeap 9646->9649 9647->9645 9647->9646 9657 be6894 9647->9657 9649->9650 9650->9545 9651 be686c RtlFreeHeap 9650->9651 9652 be9872 9651->9652 9652->9545 9656 be98a5 9653->9656 9654 be996e NtClose 9655 be9977 9654->9655 9655->9546 9656->9654 9656->9655 9658 be689c 9657->9658 9659 be68aa RtlReAllocateHeap 9658->9659 9659->9647 9661 be6844 RtlAllocateHeap 9660->9661 9662 be6e2a 9661->9662 9662->9558 9664 bee35c 9663->9664 9666 bee369 9663->9666 9665 be6844 RtlAllocateHeap 9664->9665 9664->9666 9665->9666 9666->9587 9668 be9752 9667->9668 9670 be977a 9667->9670 9669 be6844 RtlAllocateHeap 9668->9669 9669->9670 9670->9601 9672 be6844 RtlAllocateHeap 9671->9672 9673 beac4d 9672->9673 9674 beac83 9673->9674 9676 be6894 RtlReAllocateHeap 9673->9676 9679 beac66 9673->9679 9675 be686c RtlFreeHeap 9674->9675 9675->9679 9676->9673 9677 be686c RtlFreeHeap 9678 beadb0 9677->9678 9678->9606 9679->9606 9679->9677 9681 bf2f69 9680->9681 9683 bf30f7 9681->9683 9684 beb3c0 9681->9684 9683->9630 9685 beb3cf 9684->9685 9686 beb3d2 9684->9686 9685->9683 9686->9685 9687 beb419 NtSetInformationThread 9686->9687 9688 beb42e 9687->9688 9689 beb42f NtClose 9687->9689 9688->9689 9689->9685 9691 be9c5e 9690->9691 9692 be9bc3 9690->9692 9699 bf7034 9691->9699 9974 be7fbc 9692->9974 9695 be9c11 9696 be9c31 CreateMutexW 9695->9696 9978 be68ec 9696->9978 9697 bf04b4 13 API calls 9697->9695 9712 bf7051 9699->9712 9700 bf70ff 9701 bf711a CreateThread 9700->9701 9702 bf7145 CreateThread CreateThread 9700->9702 9701->9702 9704 bf7135 9701->9704 10504 be8f68 RtlAdjustPrivilege 9701->10504 9705 bf717e 9702->9705 9706 bf7183 9702->9706 10497 be782c CoInitialize 9702->10497 10499 be7468 GetLogicalDriveStringsW 9702->10499 9703 bf70bc 9703->9700 9711 be9c64 3 API calls 9703->9711 9704->9702 9984 be7ca4 OpenSCManagerW 9705->9984 9708 bf718c CreateThread 9706->9708 9709 bf71a4 9706->9709 9708->9709 10484 be7e58 9708->10484 9718 bf7221 9709->9718 9992 beb734 9709->9992 9711->9700 9712->9700 9712->9703 10123 be9c64 9712->10123 9715 bf727f 9719 bf7288 CreateThread 9715->9719 9720 bf72a3 9715->9720 9716 bf726b NtTerminateThread 9716->9715 9718->9715 9718->9716 9719->9720 10492 be9628 9719->10492 9722 bf72c3 9720->9722 9723 bf7392 9720->9723 9726 bf72cc CreateThread 9722->9726 9742 bf72e7 9722->9742 10148 bf1934 9723->10148 9724 bf7201 9725 bf7214 9724->9725 9729 bee2b8 2 API calls 9724->9729 9740 bee2b8 2 API calls 9725->9740 9726->9742 10455 bec064 9726->10455 9733 bf720f 9729->9733 9731 bf7339 9734 beb674 NtQueryInformationToken 9731->9734 10047 befc88 9733->10047 9738 bf733e 9734->9738 9736 bee2b8 2 API calls 9741 bf71f2 9736->9741 9743 bf7349 9738->9743 9744 bf7342 9738->9744 9740->9718 10016 bf0a38 9741->10016 9742->9731 10069 beda00 9742->10069 10084 be8230 9743->10084 10144 be8960 9744->10144 9748 bf7390 9748->9388 9750 bf71f7 9751 bee2b8 2 API calls 9750->9751 9753 bf71fc 9751->9753 10023 bf0be4 9753->10023 9756 bf7347 9756->9748 10117 be9640 9756->10117 9758 bf04b4 13 API calls 9758->9748 9760 be6934 RtlAllocateHeap 9759->9760 9761 bf2074 9760->9761 9762 bf2096 9761->9762 9763 bf20a5 9761->9763 9769 bf210d 9761->9769 10653 bf0000 9762->10653 10679 be7428 9763->10679 9767 bf2105 9768 be686c RtlFreeHeap 9767->9768 9768->9769 9769->9388 9770 bf2122 9772 be686c RtlFreeHeap 9770->9772 9771 be6844 RtlAllocateHeap 9806 bf20ea 9771->9806 9772->9769 9773 bf2196 9776 be686c RtlFreeHeap 9773->9776 9774 bea338 2 API calls 9774->9806 9775 bf236f 9777 be686c RtlFreeHeap 9775->9777 9776->9769 9777->9769 9778 bf228e 9782 be686c RtlFreeHeap 9778->9782 9779 be686c RtlFreeHeap 9779->9806 9780 bf22a1 10691 bea3dc 9780->10691 9781 bea280 NtSetInformationThread NtClose 9781->9806 9782->9769 9783 bf2271 9787 be686c RtlFreeHeap 9783->9787 9784 bf23a1 9785 be6984 RtlAllocateHeap 9784->9785 9791 bf23fa 9785->9791 9787->9769 9788 bf22c5 9794 bf232d 9788->9794 9795 bf2323 9788->9795 9789 bf2382 9789->9784 9790 bf2397 9789->9790 9796 be686c RtlFreeHeap 9790->9796 9797 be686c RtlFreeHeap 9791->9797 10695 be6a74 9794->10695 9799 be6984 RtlAllocateHeap 9795->9799 9796->9769 9801 bf2403 9797->9801 9798 bf22b8 9802 be686c RtlFreeHeap 9798->9802 9803 bf232b 9799->9803 9801->9769 9807 bf096c 11 API calls 9801->9807 9802->9769 9805 be686c RtlFreeHeap 9803->9805 9804 beab68 NtSetInformationThread NtClose 9804->9806 9808 bf233e 9805->9808 9806->9767 9806->9769 9806->9770 9806->9771 9806->9773 9806->9774 9806->9775 9806->9778 9806->9779 9806->9780 9806->9781 9806->9783 9806->9784 9806->9788 9806->9789 9806->9804 10685 bea958 9806->10685 9807->9769 9808->9769 10699 bf096c 9808->10699 9811 bf1d28 2 API calls 9810->9811 9812 bf1f02 9811->9812 9813 bf1f27 9812->9813 9814 bf1f06 9812->9814 9816 be9640 2 API calls 9813->9816 9815 bf1f22 9814->9815 9817 bf04b4 13 API calls 9814->9817 9815->9388 9818 bf1f2c 9816->9818 9817->9815 9819 bf1f3a 9818->9819 9820 bf1f30 9818->9820 10708 beb4dc CheckTokenMembership 9819->10708 9821 bf7034 138 API calls 9820->9821 9823 bf1f35 9821->9823 9823->9388 9824 bf2056 9824->9388 9825 bf1fb5 9826 bf1ffe 9825->9826 9830 be9c64 3 API calls 9825->9830 10709 bf0e30 9826->10709 9827 bf1f3f 9827->9824 9827->9825 9828 be9c64 3 API calls 9827->9828 9828->9825 9830->9826 9836 bf0e98 3 API calls 9837 bf2043 9836->9837 10757 bf1170 9837->10757 9840 be8230 14 API calls 9841 bf204f 9840->9841 9842 bf16ac 2 API calls 9841->9842 9842->9824 10796 bf1be8 9843->10796 9846 be8230 14 API calls 9847 bf73bf 9846->9847 9848 beb674 NtQueryInformationToken 9847->9848 9849 bf73d8 9848->9849 9850 bf7450 9849->9850 9851 be9640 2 API calls 9849->9851 9850->9388 9852 bf7430 9851->9852 9853 bf04b4 13 API calls 9852->9853 9853->9850 9855 bf3954 RtlAllocateHeap 9854->9855 9859 bf6fb2 9855->9859 9856 bf7021 9857 bf702f 9856->9857 9858 be686c RtlFreeHeap 9856->9858 9869 bf6bbc 9857->9869 9858->9857 9859->9856 9860 bf6ff6 9859->9860 10809 bf6490 9859->10809 10827 bf3ea0 9860->10827 9865 bf7017 9868 bf3ea0 2 API calls 9865->9868 9868->9856 9870 bf6d9f 9869->9870 9871 bf6bd0 9869->9871 9870->9388 9872 bf3954 RtlAllocateHeap 9871->9872 9877 bf6be0 9872->9877 9873 bf6d91 9873->9870 9875 be686c RtlFreeHeap 9873->9875 9874 be686c RtlFreeHeap 9874->9873 9875->9870 9876 bf6c86 9876->9873 9876->9874 9877->9876 9878 be6844 RtlAllocateHeap 9877->9878 9879 bf6ca8 9878->9879 9879->9876 11135 bf6688 9879->11135 9882 bf3954 RtlAllocateHeap 9881->9882 9886 bf391e 9882->9886 9883 bf3942 9884 bf3950 9883->9884 9885 be686c RtlFreeHeap 9883->9885 9884->9388 9885->9884 9886->9883 11145 bf3784 9886->11145 9889 bf6dc4 9888->9889 9890 be6de8 RtlAllocateHeap 9889->9890 9891 bf6ed5 9890->9891 9892 be6de8 RtlAllocateHeap 9891->9892 9901 bf6ede 9891->9901 9893 bf6eef 9892->9893 9897 be6de8 RtlAllocateHeap 9893->9897 9893->9901 9894 bf6f7b 9896 bf6f89 9894->9896 9898 be686c RtlFreeHeap 9894->9898 9895 be686c RtlFreeHeap 9895->9894 9899 bf6f97 9896->9899 9900 be686c RtlFreeHeap 9896->9900 9897->9901 9898->9896 9899->9417 9900->9899 9901->9894 9901->9895 9903 bf04e9 9902->9903 9904 be6de8 RtlAllocateHeap 9903->9904 9905 bf0562 9904->9905 9906 be6844 RtlAllocateHeap 9905->9906 9907 bf056b 9905->9907 9909 bf0582 9906->9909 9908 bf0930 9907->9908 9910 be686c RtlFreeHeap 9907->9910 9911 bf093e 9908->9911 9913 be686c RtlFreeHeap 9908->9913 9909->9907 11163 bf0338 9909->11163 9910->9908 9914 bf094c 9911->9914 9916 be686c RtlFreeHeap 9911->9916 9913->9911 9917 bf095a 9914->9917 9918 be686c RtlFreeHeap 9914->9918 9915 bf05b3 9915->9907 9919 bf05d4 GetTempFileNameW CreateFileW 9915->9919 9916->9914 9917->9388 9918->9917 9919->9907 9920 bf0619 WriteFile 9919->9920 9920->9907 9921 bf0635 CreateProcessW 9920->9921 9921->9907 9923 bf069f NtQueryInformationProcess 9921->9923 9923->9907 9924 bf06c3 NtReadVirtualMemory 9923->9924 9924->9907 9925 bf06ea 9924->9925 9926 be6de8 RtlAllocateHeap 9925->9926 9927 bf06f4 9926->9927 9927->9907 9928 bf0758 NtProtectVirtualMemory 9927->9928 9928->9907 9929 bf0784 NtWriteVirtualMemory 9928->9929 9929->9907 9930 bf079e 9929->9930 9930->9907 9931 bf0829 CreateNamedPipeW 9930->9931 9931->9907 9932 bf0895 ResumeThread ConnectNamedPipe 9931->9932 9932->9907 9934 bea35b 9933->9934 9935 beb3c0 2 API calls 9934->9935 9936 bea375 9934->9936 9935->9936 9936->9423 9936->9425 9938 be6934 RtlAllocateHeap 9937->9938 9970 bf2440 9938->9970 9939 bf24c6 9939->9388 9940 bea280 NtSetInformationThread NtClose 9940->9970 9941 bea338 2 API calls 9941->9970 9942 bf25bc 9944 be686c RtlFreeHeap 9942->9944 9943 bf24db 9945 be686c RtlFreeHeap 9943->9945 9944->9939 9945->9939 9946 bf24ee 9952 bea3dc 2 API calls 9946->9952 9947 bf24be 9953 be686c RtlFreeHeap 9947->9953 9948 bf25ee 9951 be6984 RtlAllocateHeap 9948->9951 9949 bf2512 9957 bf257a 9949->9957 9958 bf2570 9949->9958 9950 bf25cf 9950->9948 9954 bf25e4 9950->9954 9955 bf2647 9951->9955 9956 bf2501 9952->9956 9953->9939 9960 be686c RtlFreeHeap 9954->9960 9961 be686c RtlFreeHeap 9955->9961 9956->9949 9962 bf2505 9956->9962 9959 be6a74 RtlAllocateHeap 9957->9959 9963 be6984 RtlAllocateHeap 9958->9963 9964 bf2578 9959->9964 9960->9939 9965 bf2650 9961->9965 9966 be686c RtlFreeHeap 9962->9966 9963->9964 9968 be686c RtlFreeHeap 9964->9968 9965->9939 9971 bf096c 11 API calls 9965->9971 9966->9939 9967 beab68 NtSetInformationThread NtClose 9967->9970 9969 bf258b 9968->9969 9969->9939 9973 bf096c 11 API calls 9969->9973 9970->9939 9970->9940 9970->9941 9970->9942 9970->9943 9970->9946 9970->9947 9970->9948 9970->9949 9970->9950 9970->9967 9972 be686c RtlFreeHeap 9970->9972 9971->9939 9972->9970 9973->9939 9975 be7fd5 9974->9975 9977 be808e 9975->9977 9981 be68c0 9975->9981 9977->9695 9977->9697 9979 be686c RtlFreeHeap 9978->9979 9980 be68fb 9979->9980 9980->9691 9982 be6844 RtlAllocateHeap 9981->9982 9983 be68d6 9982->9983 9983->9977 9985 be7dda 9984->9985 9986 be7cd2 9984->9986 9987 be7df7 9985->9987 9989 be686c RtlFreeHeap 9985->9989 9988 be6844 RtlAllocateHeap 9986->9988 9987->9706 9990 be7d01 9988->9990 9989->9987 9990->9985 10177 bedc60 9990->10177 9993 be68c0 RtlAllocateHeap 9992->9993 9994 beb73c 9993->9994 9995 beb784 9994->9995 9996 beb742 NtSetInformationProcess NtSetInformationProcess NtSetInformationProcess 9994->9996 9998 bee1e8 9995->9998 9997 be68ec RtlFreeHeap 9996->9997 9997->9995 9999 bee1f5 9998->9999 10000 bee25a 9999->10000 10001 bee22a CreateThread 9999->10001 10002 beb444 NtSetInformationThread 9999->10002 10000->9718 10000->9724 10004 bea68c 10000->10004 10001->9999 10181 bede78 SetThreadPriority 10001->10181 10003 bee24b NtClose 10002->10003 10003->9999 10005 bea6b3 GetVolumeNameForVolumeMountPointW 10004->10005 10007 bea6f6 FindFirstVolumeW 10005->10007 10008 bea950 10007->10008 10014 bea712 10007->10014 10008->9736 10009 bea72b GetVolumePathNamesForVolumeNameW 10009->10014 10010 bea75c GetDriveTypeW 10010->10014 10011 bea947 FindVolumeClose 10011->10008 10012 bea7fd CreateFileW 10013 bea823 DeviceIoControl 10012->10013 10012->10014 10013->10014 10014->10009 10014->10010 10014->10011 10014->10012 10015 bea600 6 API calls 10014->10015 10015->10014 10017 bf0a92 10016->10017 10020 bf0b08 10017->10020 10022 bf0b63 10017->10022 10189 beb4dc CheckTokenMembership 10017->10189 10019 bf0b0c 10019->9750 10020->10019 10190 be6984 10020->10190 10022->9750 10024 bf0bf9 10023->10024 10194 bea488 CreateThread 10024->10194 10026 bf0c0b 10027 be6844 RtlAllocateHeap 10026->10027 10044 bf0c11 10026->10044 10029 bf0c23 10027->10029 10028 bf0e0a 10031 bf0e18 10028->10031 10033 be686c RtlFreeHeap 10028->10033 10032 bea488 6 API calls 10029->10032 10029->10044 10030 be686c RtlFreeHeap 10030->10028 10034 bf0e26 10031->10034 10036 be686c RtlFreeHeap 10031->10036 10035 bf0c40 10032->10035 10033->10031 10034->9724 10037 be6844 RtlAllocateHeap 10035->10037 10035->10044 10036->10034 10038 bf0c5b 10037->10038 10039 be6844 RtlAllocateHeap 10038->10039 10038->10044 10046 bf0c76 10039->10046 10041 be6984 RtlAllocateHeap 10042 bf0cd2 CreateThread 10041->10042 10042->10046 10212 bef308 GetFileAttributesW 10042->10212 10043 be6984 RtlAllocateHeap 10043->10046 10044->10028 10044->10030 10045 beb3c0 2 API calls 10045->10046 10046->10041 10046->10043 10046->10044 10046->10045 10202 bea1c0 CreateThread 10046->10202 10048 befcb4 10047->10048 10049 be6844 RtlAllocateHeap 10048->10049 10050 befcc1 10049->10050 10051 befcca 10050->10051 10374 bef82c CoInitialize 10050->10374 10053 beffdb 10051->10053 10055 be686c RtlFreeHeap 10051->10055 10056 beffe9 10053->10056 10058 be686c RtlFreeHeap 10053->10058 10055->10053 10059 befff7 10056->10059 10061 be686c RtlFreeHeap 10056->10061 10057 be6844 RtlAllocateHeap 10060 befcf7 10057->10060 10058->10056 10059->9725 10060->10051 10062 be6844 RtlAllocateHeap 10060->10062 10061->10059 10068 befd12 10062->10068 10063 bef59c NtSetInformationThread NtClose 10063->10068 10065 bef6d8 NtSetInformationThread NtClose 10065->10068 10066 beb3c0 2 API calls 10066->10068 10067 be686c RtlFreeHeap 10067->10068 10068->10051 10068->10063 10068->10065 10068->10066 10068->10067 10380 be69e0 10068->10380 10384 becedc 10069->10384 10071 beda42 10073 bedb6a 10071->10073 10074 be686c RtlFreeHeap 10071->10074 10072 beda39 10072->10071 10079 be6de8 RtlAllocateHeap 10072->10079 10075 bedb78 10073->10075 10077 be686c RtlFreeHeap 10073->10077 10074->10073 10076 bedb86 10075->10076 10078 be686c RtlFreeHeap 10075->10078 10076->9731 10077->10075 10078->10076 10080 beda8f 10079->10080 10080->10071 10081 be6844 RtlAllocateHeap 10080->10081 10082 bedac5 10081->10082 10082->10071 10388 becfcc 10082->10388 10085 be828b 10084->10085 10089 be8290 10084->10089 10086 be8909 10085->10086 10087 be686c RtlFreeHeap 10085->10087 10088 be686c RtlFreeHeap 10086->10088 10090 be8917 10086->10090 10087->10086 10088->10090 10089->10085 10427 bf0e98 10089->10427 10090->9756 10092 be82ed 10092->10085 10093 be6844 RtlAllocateHeap 10092->10093 10094 be83cf 10093->10094 10094->10085 10095 be83e7 10094->10095 10096 be8401 10094->10096 10097 be6de8 RtlAllocateHeap 10095->10097 10098 be6de8 RtlAllocateHeap 10096->10098 10099 be83f1 10097->10099 10098->10099 10099->10085 10100 be8434 10099->10100 10102 be8448 10099->10102 10101 be686c RtlFreeHeap 10100->10101 10101->10085 10102->10085 10103 be84fb DrawTextW 10102->10103 10103->10085 10104 be8523 10103->10104 10104->10085 10105 be865d CreateFileW 10104->10105 10105->10085 10106 be8686 WriteFile 10105->10106 10106->10085 10107 be86a7 WriteFile 10106->10107 10107->10085 10108 be86c5 WriteFile 10107->10108 10108->10085 10109 be86e3 10108->10109 10434 be6c98 10109->10434 10111 be8705 10111->10085 10112 be8788 RegCreateKeyExW 10111->10112 10112->10085 10113 be87b9 10112->10113 10114 be87f2 RegSetValueExW 10113->10114 10114->10085 10115 be881f 10114->10115 10116 be887e RegSetValueExW 10115->10116 10116->10085 10120 be9669 10117->10120 10118 be9735 10118->9758 10119 be686c RtlFreeHeap 10119->10118 10122 be9698 10120->10122 10440 bec8c4 10120->10440 10122->10118 10122->10119 10125 be9c96 10123->10125 10124 be9c9a 10124->9703 10125->10124 10446 bf3954 10125->10446 10127 bea04a 10130 bea05e 10127->10130 10131 be686c RtlFreeHeap 10127->10131 10128 be9e11 10136 beb674 NtQueryInformationToken 10128->10136 10140 be9e20 10128->10140 10129 be686c RtlFreeHeap 10129->10127 10132 bea072 10130->10132 10134 be686c RtlFreeHeap 10130->10134 10131->10130 10133 bea086 10132->10133 10135 be686c RtlFreeHeap 10132->10135 10133->9703 10134->10132 10135->10133 10137 be9ee2 10136->10137 10138 be6de8 RtlAllocateHeap 10137->10138 10137->10140 10139 be9f25 10138->10139 10139->10140 10141 be6de8 RtlAllocateHeap 10139->10141 10140->10127 10140->10129 10142 be9f45 10141->10142 10142->10140 10143 be6de8 RtlAllocateHeap 10142->10143 10143->10140 10145 be8971 10144->10145 10146 beb3c0 2 API calls 10145->10146 10147 be8b6c 10145->10147 10146->10147 10147->9756 10149 be6de8 RtlAllocateHeap 10148->10149 10150 bf1967 10149->10150 10162 bf1970 10150->10162 10449 bf18b8 10150->10449 10151 bf1aa8 10153 bf1ab6 10151->10153 10156 be686c RtlFreeHeap 10151->10156 10152 be686c RtlFreeHeap 10152->10151 10154 bf1ac4 10153->10154 10157 be686c RtlFreeHeap 10153->10157 10165 bf1d28 10154->10165 10156->10153 10157->10154 10158 bf19a4 10159 be6934 RtlAllocateHeap 10158->10159 10158->10162 10160 bf19bf 10159->10160 10161 be6de8 RtlAllocateHeap 10160->10161 10160->10162 10163 bf1a25 10161->10163 10162->10151 10162->10152 10164 be686c RtlFreeHeap 10163->10164 10164->10162 10166 bf1e2c 10165->10166 10168 bf1e5a 10166->10168 10452 bf1c34 10166->10452 10169 bf1eeb 10168->10169 10170 be686c RtlFreeHeap 10168->10170 10171 bf16ac 10169->10171 10170->10169 10172 bf16c4 10171->10172 10173 be6de8 RtlAllocateHeap 10172->10173 10174 bf16fe 10173->10174 10175 bf1707 10174->10175 10176 be686c RtlFreeHeap 10174->10176 10175->9748 10176->10175 10178 bedcba 10177->10178 10179 bedcbe NtTerminateProcess 10178->10179 10180 bedcd2 10178->10180 10179->10180 10180->9990 10184 bede8f 10181->10184 10182 bedee2 10183 bedef1 ReadFile 10183->10184 10184->10182 10184->10183 10185 bee0aa WriteFile 10184->10185 10186 bee150 NtClose 10184->10186 10187 be686c RtlFreeHeap 10184->10187 10188 bee031 WriteFile 10184->10188 10185->10184 10186->10184 10187->10184 10188->10184 10189->10020 10191 be699c 10190->10191 10192 be69b2 10191->10192 10193 be6844 RtlAllocateHeap 10191->10193 10192->10022 10193->10192 10195 bea4c8 10194->10195 10196 bea524 10194->10196 10210 bea470 GetLogicalDriveStringsW 10194->10210 10197 bea4fa ResumeThread 10195->10197 10198 beb3c0 2 API calls 10195->10198 10196->10026 10199 bea50e GetExitCodeThread 10197->10199 10200 bea4d9 10198->10200 10199->10196 10200->10197 10201 bea4dd 10200->10201 10201->10026 10203 bea24f 10202->10203 10204 bea1f3 10202->10204 10211 bea1b0 GetDriveTypeW 10202->10211 10203->10046 10205 bea225 ResumeThread 10204->10205 10206 beb3c0 2 API calls 10204->10206 10207 bea239 GetExitCodeThread 10205->10207 10208 bea204 10206->10208 10207->10203 10208->10205 10209 bea208 10208->10209 10209->10046 10213 bef37f SetThreadPriority 10212->10213 10214 bef321 10212->10214 10217 bef38e 10213->10217 10215 bef371 10214->10215 10294 bea094 FindFirstFileExW 10214->10294 10218 be686c RtlFreeHeap 10215->10218 10221 be6844 RtlAllocateHeap 10217->10221 10219 bef379 10218->10219 10236 bef3ad 10221->10236 10222 bef34b 10223 bec19c 11 API calls 10222->10223 10225 bef355 10223->10225 10227 beef6c 14 API calls 10225->10227 10229 bef36b 10227->10229 10228 be686c RtlFreeHeap 10230 bef3dd FindFirstFileExW 10228->10230 10230->10236 10231 be686c RtlFreeHeap 10231->10236 10232 bef54c 10233 be686c RtlFreeHeap 10232->10233 10235 bef56f 10233->10235 10234 bef514 FindNextFileW 10234->10236 10237 bef52c FindClose 10234->10237 10236->10228 10236->10231 10236->10232 10236->10234 10238 bef1c8 RtlAllocateHeap 10236->10238 10240 bec19c 10236->10240 10259 bef164 10236->10259 10263 beef6c 10236->10263 10237->10236 10238->10236 10241 bec1b8 10240->10241 10244 bec1b3 10240->10244 10297 be6934 10241->10297 10244->10236 10245 bec1d0 GetFileAttributesW 10246 bec1e0 10245->10246 10247 bec23e 10246->10247 10248 bec225 10246->10248 10249 bec246 10247->10249 10250 bec255 GetFileAttributesW 10247->10250 10251 bec28c 6 API calls 10248->10251 10301 bec28c CreateFileW 10249->10301 10253 bec26e CopyFileW 10250->10253 10254 bec262 10250->10254 10255 bec22d 10251->10255 10257 be686c RtlFreeHeap 10253->10257 10256 be686c RtlFreeHeap 10254->10256 10258 be686c RtlFreeHeap 10255->10258 10256->10249 10257->10244 10258->10244 10260 bef17c 10259->10260 10261 be6844 RtlAllocateHeap 10260->10261 10262 bef192 10260->10262 10261->10262 10262->10236 10264 beef8d 10263->10264 10265 bef155 10263->10265 10312 bee3ac 10264->10312 10265->10236 10268 bef14d 10269 be686c RtlFreeHeap 10268->10269 10269->10265 10271 beefa5 10271->10268 10272 beefcc 10271->10272 10273 beefb9 10271->10273 10349 beece4 10272->10349 10345 beec00 10273->10345 10276 beefe7 MoveFileExW 10277 beeff9 10276->10277 10285 beefc7 10276->10285 10280 bef051 CreateFileW 10277->10280 10290 bef075 10277->10290 10278 bef034 10281 be686c RtlFreeHeap 10278->10281 10279 be686c RtlFreeHeap 10279->10285 10282 bef07a 10280->10282 10280->10290 10281->10277 10325 beed30 10282->10325 10283 beece4 RtlAllocateHeap 10283->10285 10284 be686c RtlFreeHeap 10284->10268 10285->10268 10285->10276 10285->10277 10285->10278 10285->10279 10285->10283 10288 bef0a3 CreateIoCompletionPort 10289 bef0ba 10288->10289 10292 bef0dc 10288->10292 10291 be686c RtlFreeHeap 10289->10291 10290->10268 10290->10284 10291->10290 10292->10290 10293 be686c RtlFreeHeap 10292->10293 10293->10290 10295 bea0e5 10294->10295 10296 bea0c5 FindClose 10294->10296 10295->10215 10295->10222 10296->10295 10298 be694a 10297->10298 10299 be6961 10298->10299 10300 be6844 RtlAllocateHeap 10298->10300 10299->10244 10299->10245 10300->10299 10302 bec3ed 10301->10302 10303 bec2bd 10301->10303 10302->10244 10304 bec2f5 WriteFile 10303->10304 10305 bec32c WriteFile 10304->10305 10306 bec31a 10304->10306 10307 bec365 WriteFile 10305->10307 10308 bec353 NtClose 10305->10308 10306->10244 10309 bec39c WriteFile 10307->10309 10310 bec38a 10307->10310 10308->10244 10309->10303 10311 bec3c3 10309->10311 10310->10244 10311->10244 10313 bee3c5 SetFileAttributesW CreateFileW 10312->10313 10315 bee40b 10313->10315 10316 bee3f3 10313->10316 10315->10268 10317 bee45c SetFileAttributesW CreateFileW 10315->10317 10316->10313 10316->10315 10353 bede48 10316->10353 10318 bee49c SetFilePointerEx 10317->10318 10319 bee508 10317->10319 10318->10319 10320 bee4bb ReadFile 10318->10320 10319->10271 10320->10319 10321 bee4da 10320->10321 10322 bee350 RtlAllocateHeap 10321->10322 10323 bee4eb 10322->10323 10323->10319 10324 be686c RtlFreeHeap 10323->10324 10324->10319 10326 beed60 10325->10326 10327 beed91 10326->10327 10329 bee2b8 2 API calls 10326->10329 10328 be6844 RtlAllocateHeap 10327->10328 10330 beed9d 10328->10330 10329->10327 10337 be6844 RtlAllocateHeap 10330->10337 10344 beeee4 10330->10344 10331 beef39 10333 be686c RtlFreeHeap 10331->10333 10334 beef47 10331->10334 10332 be686c RtlFreeHeap 10332->10331 10333->10334 10335 beef55 10334->10335 10336 be686c RtlFreeHeap 10334->10336 10335->10288 10335->10290 10336->10335 10338 beedfa 10337->10338 10339 be6844 RtlAllocateHeap 10338->10339 10338->10344 10340 beee29 10339->10340 10341 be6844 RtlAllocateHeap 10340->10341 10340->10344 10342 beeedb 10341->10342 10343 be686c RtlFreeHeap 10342->10343 10342->10344 10343->10344 10344->10331 10344->10332 10346 beec0d 10345->10346 10347 be6934 RtlAllocateHeap 10346->10347 10348 beec19 10347->10348 10348->10285 10350 beecf2 10349->10350 10351 be6934 RtlAllocateHeap 10350->10351 10352 beed01 10351->10352 10352->10285 10354 bede53 10353->10354 10355 bede60 10354->10355 10359 bedce4 10354->10359 10357 bede66 Sleep 10355->10357 10358 bede71 10355->10358 10357->10358 10358->10316 10362 bedd1b 10359->10362 10360 beddf0 10361 bede3d 10360->10361 10363 be686c RtlFreeHeap 10360->10363 10361->10355 10362->10360 10364 be6844 RtlAllocateHeap 10362->10364 10363->10361 10366 bedd74 10364->10366 10365 bedd9d 10365->10360 10369 bedc60 NtTerminateProcess 10365->10369 10370 bedb90 10365->10370 10366->10360 10366->10365 10367 be6894 RtlReAllocateHeap 10366->10367 10367->10366 10369->10365 10371 bedbb0 10370->10371 10372 bedc2d 10371->10372 10373 bedc60 NtTerminateProcess 10371->10373 10372->10365 10373->10372 10375 befa12 10374->10375 10377 bef869 10374->10377 10375->10051 10375->10057 10376 be6844 RtlAllocateHeap 10376->10377 10377->10376 10378 bef8ee 10377->10378 10378->10375 10379 be6844 RtlAllocateHeap 10378->10379 10379->10378 10381 be69f9 10380->10381 10382 be6844 RtlAllocateHeap 10381->10382 10383 be6a19 10382->10383 10383->10068 10386 becef8 10384->10386 10385 becf7d 10385->10072 10386->10385 10387 be6844 RtlAllocateHeap 10386->10387 10387->10385 10389 bed024 10388->10389 10392 bed01f 10388->10392 10390 be6844 RtlAllocateHeap 10389->10390 10389->10392 10401 bed065 10390->10401 10391 bed45e 10394 bed46c 10391->10394 10395 be686c RtlFreeHeap 10391->10395 10392->10391 10393 be686c RtlFreeHeap 10392->10393 10393->10391 10396 bed47a 10394->10396 10397 be686c RtlFreeHeap 10394->10397 10395->10394 10398 bed488 10396->10398 10399 be686c RtlFreeHeap 10396->10399 10397->10396 10400 bed496 10398->10400 10402 be686c RtlFreeHeap 10398->10402 10399->10398 10403 bed4a4 10400->10403 10406 be686c RtlFreeHeap 10400->10406 10401->10392 10415 bed67c 10401->10415 10402->10400 10403->10071 10405 bed08e 10405->10392 10419 bed4b0 10405->10419 10406->10403 10408 bed0a1 10408->10392 10423 bed638 10408->10423 10411 be6de8 RtlAllocateHeap 10412 bed0cc 10411->10412 10412->10392 10413 be6844 RtlAllocateHeap 10412->10413 10414 be686c RtlFreeHeap 10412->10414 10413->10412 10414->10412 10416 bed6a7 10415->10416 10417 be6844 RtlAllocateHeap 10416->10417 10418 bed7a4 10417->10418 10418->10405 10420 bed540 10419->10420 10421 be6844 RtlAllocateHeap 10420->10421 10422 bed57e 10421->10422 10422->10408 10424 bed657 10423->10424 10425 be6de8 RtlAllocateHeap 10424->10425 10426 bed0b4 10425->10426 10426->10392 10426->10411 10428 bf0edf 10427->10428 10429 bf0fee RegCreateKeyExW 10428->10429 10433 bf0f2c 10428->10433 10430 bf101b RegQueryValueExW 10429->10430 10429->10433 10431 bf104a 10430->10431 10432 bf1096 RegDeleteKeyExW 10431->10432 10431->10433 10432->10433 10433->10092 10435 be6cbb 10434->10435 10436 be6cd2 NtQueryInformationToken 10434->10436 10435->10436 10437 be6ccd 10435->10437 10436->10437 10438 be6d24 10437->10438 10439 be686c RtlFreeHeap 10437->10439 10438->10111 10439->10438 10441 bec8e5 10440->10441 10442 be6844 RtlAllocateHeap 10441->10442 10444 bec8f5 10442->10444 10443 bec917 10443->10122 10444->10443 10445 be686c RtlFreeHeap 10444->10445 10445->10443 10447 be6844 RtlAllocateHeap 10446->10447 10448 bf396b 10447->10448 10448->10128 10450 be6844 RtlAllocateHeap 10449->10450 10451 bf18ce 10450->10451 10451->10158 10453 be6844 RtlAllocateHeap 10452->10453 10454 bf1c4e 10453->10454 10454->10168 10456 be6de8 RtlAllocateHeap 10455->10456 10457 bec080 10456->10457 10458 bec16b 10457->10458 10459 be6844 RtlAllocateHeap 10457->10459 10460 bec179 10458->10460 10461 be686c RtlFreeHeap 10458->10461 10466 bec097 10459->10466 10462 bec187 10460->10462 10463 be686c RtlFreeHeap 10460->10463 10461->10460 10464 bec195 10462->10464 10465 be686c RtlFreeHeap 10462->10465 10463->10462 10465->10464 10466->10458 10467 be686c RtlFreeHeap 10466->10467 10468 bec0c5 10467->10468 10469 be6844 RtlAllocateHeap 10468->10469 10470 bec0d5 10469->10470 10470->10458 10471 be6ee4 2 API calls 10470->10471 10472 bec0eb 10471->10472 10473 be686c RtlFreeHeap 10472->10473 10474 bec108 10473->10474 10519 bebf94 10474->10519 10477 bec14a 10478 bebf94 8 API calls 10477->10478 10480 bec155 10478->10480 10479 beb3c0 2 API calls 10479->10477 10481 bebf94 8 API calls 10480->10481 10482 bec160 10481->10482 10483 bebf94 8 API calls 10482->10483 10483->10458 10487 be7e60 10484->10487 10485 be6844 RtlAllocateHeap 10485->10487 10486 be7e72 NtQuerySystemInformation 10486->10487 10487->10485 10487->10486 10488 be686c RtlFreeHeap 10487->10488 10489 be6894 RtlReAllocateHeap 10487->10489 10490 be686c RtlFreeHeap 10487->10490 10488->10487 10489->10487 10491 be7f40 Sleep 10490->10491 10491->10487 10550 be91c8 10492->10550 10494 be962d 10495 be963c 10494->10495 10567 be90bc 10494->10567 10498 be7861 10497->10498 10500 be74b3 10499->10500 10502 be748b 10499->10502 10501 be7494 GetDriveTypeW 10501->10502 10502->10500 10502->10501 10579 be74bc 10502->10579 10505 be97d8 4 API calls 10504->10505 10506 be8fa0 10505->10506 10507 be9880 NtClose 10506->10507 10510 be9010 10506->10510 10508 be8fae 10507->10508 10508->10510 10511 be8fb7 NtSetInformationThread 10508->10511 10509 be9035 10510->10509 10650 be8ecc 10510->10650 10511->10510 10513 be8fcb 10511->10513 10635 be8da8 10513->10635 10516 be9880 NtClose 10517 be8fee 10516->10517 10517->10510 10644 be8be0 10517->10644 10520 bebfb9 10519->10520 10521 bec04f 10520->10521 10522 be6844 RtlAllocateHeap 10520->10522 10523 bec05d 10521->10523 10524 be686c RtlFreeHeap 10521->10524 10525 bebfcb 10522->10525 10523->10477 10523->10479 10524->10523 10525->10521 10528 bebed0 10525->10528 10533 bebc38 10525->10533 10529 be6934 RtlAllocateHeap 10528->10529 10530 bebeec 10529->10530 10531 bebf8a 10530->10531 10532 be686c RtlFreeHeap 10530->10532 10531->10525 10532->10531 10536 bebc60 10533->10536 10534 bebeaa 10538 bebeb8 10534->10538 10539 be686c RtlFreeHeap 10534->10539 10535 bebea1 DeleteDC 10535->10534 10537 be6844 RtlAllocateHeap 10536->10537 10547 bebc64 10536->10547 10540 bebc8d 10537->10540 10538->10525 10539->10538 10541 bebce0 CreateDCW 10540->10541 10540->10547 10542 bebcfd 10541->10542 10541->10547 10543 bebd9e StartDocW 10542->10543 10546 bebdce 10543->10546 10543->10547 10544 bebdec 10545 bebe6c EndDoc 10544->10545 10545->10547 10546->10544 10548 bebe18 DrawTextA 10546->10548 10547->10534 10547->10535 10549 bebe5a EndPage 10548->10549 10549->10545 10549->10546 10551 be92a9 10550->10551 10552 be946d RegCreateKeyExW 10551->10552 10553 be94c7 RegCreateKeyExW 10552->10553 10563 be94a1 RegEnumKeyW 10552->10563 10556 be95bc RegEnumKeyW 10553->10556 10557 be95e2 10553->10557 10556->10557 10561 be95e4 OpenEventLogW 10556->10561 10557->10494 10558 be94cc RegCreateKeyExW 10560 be94fa RegSetValueExW 10558->10560 10558->10563 10562 be951c RegSetValueExW 10560->10562 10560->10563 10561->10556 10564 be95fc ClearEventLogW 10561->10564 10562->10563 10565 be953a OpenEventLogW 10562->10565 10563->10553 10563->10558 10564->10556 10565->10563 10566 be9552 ClearEventLogW CloseEventLog 10565->10566 10566->10563 10574 be903c RtlAdjustPrivilege 10567->10574 10569 be9194 10570 be91ac CloseServiceHandle 10569->10570 10571 be91b5 10569->10571 10570->10571 10571->10495 10572 be90d5 10572->10569 10573 bedc60 NtTerminateProcess 10572->10573 10573->10569 10575 be97d8 4 API calls 10574->10575 10576 be9074 10575->10576 10577 be9880 NtClose 10576->10577 10578 be9082 10576->10578 10577->10578 10578->10572 10587 be7590 10579->10587 10581 be74d4 10582 be7506 FindFirstFileExW 10581->10582 10584 be7580 10581->10584 10582->10584 10585 be752e 10582->10585 10583 be756c FindNextFileW 10583->10584 10583->10585 10584->10502 10585->10583 10591 be766c 10585->10591 10588 be75b0 FindFirstFileExW 10587->10588 10590 be760e 10588->10590 10590->10581 10592 be768e 10591->10592 10593 be7822 10592->10593 10594 be6844 RtlAllocateHeap 10592->10594 10593->10583 10598 be76a6 10594->10598 10595 be77fd 10596 be7814 10595->10596 10597 be686c RtlFreeHeap 10595->10597 10596->10593 10599 be686c RtlFreeHeap 10596->10599 10597->10596 10598->10595 10600 be76de FindFirstFileExW 10598->10600 10599->10593 10600->10595 10602 be7706 10600->10602 10601 be77e5 FindNextFileW 10601->10595 10601->10602 10602->10601 10603 be6844 RtlAllocateHeap 10602->10603 10604 be7780 GetFileAttributesW 10602->10604 10606 be766c 11 API calls 10602->10606 10607 be686c RtlFreeHeap 10602->10607 10608 be6668 10602->10608 10603->10602 10604->10602 10606->10602 10607->10602 10609 be667e 10608->10609 10609->10609 10610 bea094 2 API calls 10609->10610 10611 be6695 10610->10611 10612 be66a5 CreateFileW 10611->10612 10613 be67a5 10611->10613 10612->10613 10617 be66cd 10612->10617 10615 be67d4 NtFreeVirtualMemory 10613->10615 10616 be67f9 10613->10616 10614 be66d2 NtAllocateVirtualMemory 10614->10617 10623 be6703 10614->10623 10615->10613 10626 be6550 10616->10626 10617->10614 10617->10623 10620 be6763 WriteFile 10622 be677d SetFilePointerEx 10620->10622 10620->10623 10621 be6821 10624 be6836 10621->10624 10625 be686c RtlFreeHeap 10621->10625 10622->10620 10622->10623 10623->10613 10623->10620 10624->10602 10625->10624 10627 be6934 RtlAllocateHeap 10626->10627 10628 be656a 10627->10628 10629 be6573 10628->10629 10630 be6934 RtlAllocateHeap 10628->10630 10631 be661e DeleteFileW 10629->10631 10632 be686c RtlFreeHeap 10629->10632 10633 be6582 10630->10633 10631->10621 10632->10631 10633->10629 10634 be65df MoveFileExW 10633->10634 10634->10629 10634->10633 10636 be97d8 4 API calls 10635->10636 10637 be8dd3 10636->10637 10638 be8ec2 10637->10638 10639 be8de0 OpenSCManagerW 10637->10639 10638->10510 10638->10516 10643 be8df9 10639->10643 10640 be8eaa CloseServiceHandle 10641 be8eb3 10640->10641 10641->10638 10642 be8eb9 CloseServiceHandle 10641->10642 10642->10638 10643->10640 10643->10641 10645 be8c11 10644->10645 10647 be6844 RtlAllocateHeap 10645->10647 10649 be8c4d 10645->10649 10646 be8d9c 10646->10510 10647->10649 10648 be686c RtlFreeHeap 10648->10646 10649->10646 10649->10648 10651 be97d8 4 API calls 10650->10651 10652 be8ee5 10651->10652 10652->10509 10704 bef59c 10653->10704 10656 bef59c 2 API calls 10658 bf0080 10656->10658 10657 bf0313 10660 bf0321 10657->10660 10662 be686c RtlFreeHeap 10657->10662 10661 bf00a8 10658->10661 10663 bef59c 2 API calls 10658->10663 10659 be686c RtlFreeHeap 10659->10657 10664 bf032f 10660->10664 10667 be686c RtlFreeHeap 10660->10667 10665 be6844 RtlAllocateHeap 10661->10665 10675 bf00d1 10661->10675 10662->10660 10663->10661 10664->9388 10666 bf00c8 10665->10666 10668 be6844 RtlAllocateHeap 10666->10668 10666->10675 10667->10664 10669 bf00e3 10668->10669 10670 bee1e8 9 API calls 10669->10670 10669->10675 10671 bf00f6 10670->10671 10672 be69e0 RtlAllocateHeap 10671->10672 10673 bf028d 10671->10673 10676 bef6d8 NtSetInformationThread NtClose 10671->10676 10677 beb3c0 2 API calls 10671->10677 10678 be686c RtlFreeHeap 10671->10678 10672->10671 10674 be686c RtlFreeHeap 10673->10674 10673->10675 10674->10675 10675->10657 10675->10659 10676->10671 10677->10671 10678->10671 10680 be7433 10679->10680 10681 be6934 RtlAllocateHeap 10680->10681 10683 be7441 10681->10683 10682 be7464 10682->9806 10683->10682 10684 be686c RtlFreeHeap 10683->10684 10684->10682 10686 bea983 10685->10686 10687 bea488 6 API calls 10686->10687 10689 bea99a 10687->10689 10688 bea9c9 10688->9806 10689->10688 10690 be6844 RtlAllocateHeap 10689->10690 10690->10688 10692 bea3ff 10691->10692 10693 beb3c0 2 API calls 10692->10693 10694 bea419 10692->10694 10693->10694 10694->9788 10694->9798 10696 be6a8d 10695->10696 10697 be6844 RtlAllocateHeap 10696->10697 10698 be6aa3 10696->10698 10697->10698 10698->9803 10700 bee1e8 9 API calls 10699->10700 10701 bf0977 10700->10701 10702 beb3c0 2 API calls 10701->10702 10703 bf09c8 10701->10703 10702->10703 10703->9769 10705 bef5f6 10704->10705 10706 beb3c0 2 API calls 10705->10706 10707 bef610 10705->10707 10706->10707 10707->10656 10707->10661 10708->9827 10710 bf0e8d 10709->10710 10711 bf0e48 10709->10711 10710->9824 10715 bf1400 10710->10715 10712 bec8c4 2 API calls 10711->10712 10714 bf0e4d 10712->10714 10713 be686c RtlFreeHeap 10713->10710 10714->10710 10714->10713 10767 bf1240 10715->10767 10717 bf1441 10718 be6de8 RtlAllocateHeap 10717->10718 10743 bf1445 10717->10743 10719 bf1454 10718->10719 10719->10743 10789 bf1611 10719->10789 10720 bf15e0 10722 bf15ee 10720->10722 10723 be686c RtlFreeHeap 10720->10723 10721 be686c RtlFreeHeap 10721->10720 10724 bf15fc 10722->10724 10726 be686c RtlFreeHeap 10722->10726 10723->10722 10725 bf160a 10724->10725 10727 be686c RtlFreeHeap 10724->10727 10725->9824 10744 bf1760 10725->10744 10726->10724 10727->10725 10730 be6de8 RtlAllocateHeap 10731 bf149b 10730->10731 10732 bf1611 RtlFreeHeap 10731->10732 10731->10743 10733 bf14d4 10732->10733 10734 be6de8 RtlAllocateHeap 10733->10734 10735 bf14de 10734->10735 10736 bf1611 RtlFreeHeap 10735->10736 10735->10743 10737 bf1521 10736->10737 10738 be6de8 RtlAllocateHeap 10737->10738 10739 bf152b 10738->10739 10740 bf1611 RtlFreeHeap 10739->10740 10739->10743 10741 bf156b 10740->10741 10742 be6de8 RtlAllocateHeap 10741->10742 10742->10743 10743->10720 10743->10721 10745 be6de8 RtlAllocateHeap 10744->10745 10750 bf1791 10745->10750 10746 bf179a 10747 bf1890 10746->10747 10748 be686c RtlFreeHeap 10746->10748 10749 bf189e 10747->10749 10751 be686c RtlFreeHeap 10747->10751 10748->10747 10749->9824 10749->9836 10750->10746 10752 bf18b8 RtlAllocateHeap 10750->10752 10751->10749 10753 bf17ce 10752->10753 10753->10746 10754 be6de8 RtlAllocateHeap 10753->10754 10755 bf1809 10754->10755 10756 be686c RtlFreeHeap 10755->10756 10756->10746 10758 bf1190 10757->10758 10759 be6de8 RtlAllocateHeap 10758->10759 10766 bf1195 10758->10766 10764 bf11a1 10759->10764 10760 bf1219 10762 bf1227 10760->10762 10763 be686c RtlFreeHeap 10760->10763 10761 be686c RtlFreeHeap 10761->10760 10762->9840 10763->10762 10765 be6de8 RtlAllocateHeap 10764->10765 10764->10766 10765->10766 10766->10760 10766->10761 10768 bf126f 10767->10768 10770 bf1282 10767->10770 10769 be6de8 RtlAllocateHeap 10768->10769 10768->10770 10771 bf128d 10769->10771 10781 bf130f 10770->10781 10793 bf10cc 10770->10793 10771->10770 10772 be6de8 RtlAllocateHeap 10771->10772 10774 bf12a5 10772->10774 10774->10770 10776 bf12b4 10774->10776 10775 bf1336 10778 be6934 RtlAllocateHeap 10775->10778 10777 be6de8 RtlAllocateHeap 10776->10777 10779 bf12bd 10777->10779 10780 bf1345 10778->10780 10779->10717 10780->10781 10782 be6934 RtlAllocateHeap 10780->10782 10781->10717 10784 bf1377 10782->10784 10783 bf13bd 10786 bf13cb 10783->10786 10787 be686c RtlFreeHeap 10783->10787 10784->10781 10784->10783 10785 be686c RtlFreeHeap 10784->10785 10785->10783 10786->10781 10788 be686c RtlFreeHeap 10786->10788 10787->10786 10788->10781 10790 bf1617 10789->10790 10791 bf1491 10789->10791 10792 be686c RtlFreeHeap 10790->10792 10791->10730 10792->10791 10794 be6844 RtlAllocateHeap 10793->10794 10795 bf10e2 10794->10795 10795->10775 10797 bf1bef 10796->10797 10800 bf1b50 10797->10800 10799 bf1c07 10799->9846 10801 be6844 RtlAllocateHeap 10800->10801 10802 bf1b67 10801->10802 10803 bf1b9d 10802->10803 10805 be6894 RtlReAllocateHeap 10802->10805 10806 bf1b80 10802->10806 10804 be686c RtlFreeHeap 10803->10804 10804->10806 10805->10802 10806->10799 10807 be686c RtlFreeHeap 10806->10807 10808 bf1be0 10807->10808 10808->10799 10812 bf64b6 10809->10812 10810 bf65f0 10810->9860 10811 be686c RtlFreeHeap 10811->10810 10826 bf64ce 10812->10826 10861 bf6124 10812->10861 10826->10810 10826->10811 10828 bf3fa4 10827->10828 10830 bf3fd5 10828->10830 11122 bf3d98 10828->11122 10831 bf4066 10830->10831 10832 be686c RtlFreeHeap 10830->10832 10831->9856 10833 bf4508 10831->10833 10832->10831 10834 bf452e 10833->10834 10852 bf4532 10834->10852 11125 bf2af8 10834->11125 10837 bf4684 10840 bf4692 10837->10840 10841 be686c RtlFreeHeap 10837->10841 10838 be6844 RtlAllocateHeap 10842 bf4553 10838->10842 10839 be686c RtlFreeHeap 10839->10837 10843 bf46a0 10840->10843 10844 be686c RtlFreeHeap 10840->10844 10841->10840 10845 be9640 2 API calls 10842->10845 10842->10852 10843->9865 10853 bf46a8 10843->10853 10844->10843 10846 bf4566 10845->10846 10847 bef82c 2 API calls 10846->10847 10848 bf457f 10847->10848 10849 be6844 RtlAllocateHeap 10848->10849 10848->10852 10850 bf459d 10849->10850 10851 be6844 RtlAllocateHeap 10850->10851 10850->10852 10851->10852 10852->10837 10852->10839 10854 bf46b9 10853->10854 10855 bf48ba 10854->10855 10856 be9640 2 API calls 10854->10856 10855->9865 10857 bf46c7 10856->10857 10857->10855 10858 be6de8 RtlAllocateHeap 10857->10858 10860 bf46e1 10858->10860 10859 be686c RtlFreeHeap 10859->10855 10860->10855 10860->10859 11093 bf60a8 10861->11093 10863 bf6450 10865 bf645e 10863->10865 10866 be686c RtlFreeHeap 10863->10866 10864 be686c RtlFreeHeap 10864->10863 10867 bf646c 10865->10867 10869 be686c RtlFreeHeap 10865->10869 10866->10865 10870 bf647a 10867->10870 10871 be686c RtlFreeHeap 10867->10871 10869->10867 10872 bf6488 10870->10872 10874 be686c RtlFreeHeap 10870->10874 10871->10870 10872->10826 10884 bf5d28 10872->10884 10873 be6844 RtlAllocateHeap 10875 bf61a8 10873->10875 10874->10872 10876 be6844 RtlAllocateHeap 10875->10876 10882 bf616c 10875->10882 10877 bf6249 10876->10877 10878 be6844 RtlAllocateHeap 10877->10878 10877->10882 10879 bf6299 10878->10879 10880 be6844 RtlAllocateHeap 10879->10880 10879->10882 10881 bf6344 10880->10881 10881->10882 10883 be686c RtlFreeHeap 10881->10883 10882->10863 10882->10864 10883->10882 10885 bf5d8f 10884->10885 10886 be6de8 RtlAllocateHeap 10885->10886 10893 bf5da4 10885->10893 10891 bf5e1b 10886->10891 10887 bf608f 10889 bf609d 10887->10889 10890 be686c RtlFreeHeap 10887->10890 10888 be686c RtlFreeHeap 10888->10887 10889->10826 10894 bf4c60 10889->10894 10890->10889 10892 be6de8 RtlAllocateHeap 10891->10892 10891->10893 10892->10893 10893->10887 10893->10888 10895 be6844 RtlAllocateHeap 10894->10895 10896 bf4c93 10895->10896 10900 be6844 RtlAllocateHeap 10896->10900 10906 bf4c9c 10896->10906 10897 be686c RtlFreeHeap 10899 bf4e1b 10897->10899 10898 bf4e29 10902 bf4e37 10898->10902 10903 be686c RtlFreeHeap 10898->10903 10899->10898 10901 be686c RtlFreeHeap 10899->10901 10904 bf4cc6 10900->10904 10901->10898 10902->10826 10907 bf5a84 10902->10907 10903->10902 10905 be6844 RtlAllocateHeap 10904->10905 10904->10906 10905->10906 10906->10897 10906->10899 10908 be6844 RtlAllocateHeap 10907->10908 10912 bf5add 10908->10912 10909 bf5caa 10911 bf5cb8 10909->10911 10913 be686c RtlFreeHeap 10909->10913 10910 be686c RtlFreeHeap 10910->10909 10915 be686c RtlFreeHeap 10911->10915 10916 bf5cc6 10911->10916 10944 bf5ae6 10912->10944 11099 bf497c 10912->11099 10913->10911 10915->10916 10917 bf5cd4 10916->10917 10919 be686c RtlFreeHeap 10916->10919 10920 bf5ce2 10917->10920 10922 be686c RtlFreeHeap 10917->10922 10918 bf5b0e 10918->10944 11102 bf4a30 10918->11102 10919->10917 10921 bf5cf0 10920->10921 10923 be686c RtlFreeHeap 10920->10923 10924 bf5cfe 10921->10924 10925 be686c RtlFreeHeap 10921->10925 10922->10920 10923->10921 10926 bf5d0c 10924->10926 10927 be686c RtlFreeHeap 10924->10927 10925->10924 10926->10826 10946 bf57b4 10926->10946 10927->10926 10929 bf5b3a 10930 be686c RtlFreeHeap 10929->10930 10929->10944 10931 bf5b5c 10930->10931 10932 bf4a30 RtlAllocateHeap 10931->10932 10933 bf5b75 10932->10933 10933->10944 11105 bf4aa8 10933->11105 10935 bf5bbd 10935->10944 11108 bf4c08 10935->11108 10938 be6844 RtlAllocateHeap 10939 bf5bf2 10938->10939 10940 be6de8 RtlAllocateHeap 10939->10940 10939->10944 10941 bf5c0a 10940->10941 10942 be6844 RtlAllocateHeap 10941->10942 10941->10944 10943 bf5c33 10942->10943 10943->10944 10945 be686c RtlFreeHeap 10943->10945 10944->10909 10944->10910 10945->10943 10947 be6844 RtlAllocateHeap 10946->10947 10948 bf57fc 10947->10948 10949 be6844 RtlAllocateHeap 10948->10949 10970 bf5805 10948->10970 10960 bf5814 10949->10960 10950 bf5a22 10952 bf5a30 10950->10952 10953 be686c RtlFreeHeap 10950->10953 10951 be686c RtlFreeHeap 10951->10950 10954 bf5a3e 10952->10954 10955 be686c RtlFreeHeap 10952->10955 10953->10952 10956 bf5a4c 10954->10956 10957 be686c RtlFreeHeap 10954->10957 10955->10954 10958 bf5a5a 10956->10958 10959 be686c RtlFreeHeap 10956->10959 10957->10956 10958->10826 10971 bf4e50 10958->10971 10959->10958 10961 be6844 RtlAllocateHeap 10960->10961 10960->10970 10962 bf5943 10961->10962 10963 be6de8 RtlAllocateHeap 10962->10963 10962->10970 10964 bf595b 10963->10964 10965 be686c RtlFreeHeap 10964->10965 10964->10970 10966 bf59a4 10965->10966 10967 be6844 RtlAllocateHeap 10966->10967 10968 bf59bd 10967->10968 10969 be6de8 RtlAllocateHeap 10968->10969 10968->10970 10969->10970 10970->10950 10970->10951 10972 be6844 RtlAllocateHeap 10971->10972 10974 bf4e98 10972->10974 10973 bf5065 10977 be686c RtlFreeHeap 10973->10977 10978 bf5073 10973->10978 10976 bf497c RtlAllocateHeap 10974->10976 11008 bf4ea1 10974->11008 10975 be686c RtlFreeHeap 10975->10973 10990 bf4ec9 10976->10990 10977->10978 10979 bf5081 10978->10979 10980 be686c RtlFreeHeap 10978->10980 10981 bf508f 10979->10981 10982 be686c RtlFreeHeap 10979->10982 10980->10979 10983 bf509d 10981->10983 10984 be686c RtlFreeHeap 10981->10984 10982->10981 10985 bf50ab 10983->10985 10986 be686c RtlFreeHeap 10983->10986 10984->10983 10987 bf50b9 10985->10987 10988 be686c RtlFreeHeap 10985->10988 10986->10985 10989 bf50c7 10987->10989 10991 be686c RtlFreeHeap 10987->10991 10988->10987 10989->10826 11010 bf50e0 10989->11010 10990->11008 11113 bf4920 10990->11113 10991->10989 10993 bf4ef5 10994 be686c RtlFreeHeap 10993->10994 10993->11008 10995 bf4f17 10994->10995 10996 bf4920 RtlAllocateHeap 10995->10996 10997 bf4f30 10996->10997 10998 bf4aa8 RtlAllocateHeap 10997->10998 10997->11008 10999 bf4f78 10998->10999 11000 bf4c08 RtlAllocateHeap 10999->11000 10999->11008 11001 bf4f8d 11000->11001 11002 be6844 RtlAllocateHeap 11001->11002 11001->11008 11003 bf4fad 11002->11003 11004 be6de8 RtlAllocateHeap 11003->11004 11003->11008 11005 bf4fc5 11004->11005 11006 be6844 RtlAllocateHeap 11005->11006 11005->11008 11007 bf4fee 11006->11007 11007->11008 11009 be686c RtlFreeHeap 11007->11009 11008->10973 11008->10975 11009->11007 11011 be6844 RtlAllocateHeap 11010->11011 11020 bf5143 11011->11020 11012 bf571b 11014 bf5729 11012->11014 11015 be686c RtlFreeHeap 11012->11015 11013 be686c RtlFreeHeap 11013->11012 11016 bf5737 11014->11016 11017 be686c RtlFreeHeap 11014->11017 11015->11014 11018 bf5745 11016->11018 11021 be686c RtlFreeHeap 11016->11021 11017->11016 11019 bf5753 11018->11019 11022 be686c RtlFreeHeap 11018->11022 11023 bf5761 11019->11023 11024 be686c RtlFreeHeap 11019->11024 11033 be6844 RtlAllocateHeap 11020->11033 11052 bf514c 11020->11052 11021->11018 11022->11019 11025 bf576f 11023->11025 11026 be686c RtlFreeHeap 11023->11026 11024->11023 11027 bf577d 11025->11027 11028 be686c RtlFreeHeap 11025->11028 11026->11025 11029 bf578b 11027->11029 11031 be686c RtlFreeHeap 11027->11031 11028->11027 11030 bf5799 11029->11030 11032 be686c RtlFreeHeap 11029->11032 11030->10826 11031->11029 11032->11030 11034 bf51ff 11033->11034 11035 bf497c RtlAllocateHeap 11034->11035 11034->11052 11036 bf5230 11035->11036 11036->11052 11116 bf48c4 11036->11116 11038 bf525c 11039 be686c RtlFreeHeap 11038->11039 11038->11052 11040 bf527e 11039->11040 11041 bf48c4 RtlAllocateHeap 11040->11041 11042 bf5297 11041->11042 11043 bf4aa8 RtlAllocateHeap 11042->11043 11042->11052 11044 bf52df 11043->11044 11045 bf4c08 RtlAllocateHeap 11044->11045 11044->11052 11046 bf52f4 11045->11046 11047 be6844 RtlAllocateHeap 11046->11047 11046->11052 11048 bf533d 11047->11048 11049 be6de8 RtlAllocateHeap 11048->11049 11048->11052 11050 bf5355 11049->11050 11051 be6844 RtlAllocateHeap 11050->11051 11050->11052 11053 bf5381 11051->11053 11052->11012 11052->11013 11053->11052 11054 be686c RtlFreeHeap 11053->11054 11055 bf5427 11054->11055 11056 bf5435 11055->11056 11057 be686c RtlFreeHeap 11055->11057 11058 bf544a 11056->11058 11059 be686c RtlFreeHeap 11056->11059 11057->11056 11060 bf545f 11058->11060 11062 be686c RtlFreeHeap 11058->11062 11059->11058 11061 bf5474 11060->11061 11063 be686c RtlFreeHeap 11060->11063 11064 bf5489 11061->11064 11065 be686c RtlFreeHeap 11061->11065 11062->11060 11063->11061 11066 bf549e 11064->11066 11067 be686c RtlFreeHeap 11064->11067 11065->11064 11068 bf54b3 11066->11068 11070 be686c RtlFreeHeap 11066->11070 11067->11066 11069 bf54c8 11068->11069 11071 be686c RtlFreeHeap 11068->11071 11072 be6844 RtlAllocateHeap 11069->11072 11070->11068 11071->11069 11073 bf54ef 11072->11073 11073->11052 11074 bf497c RtlAllocateHeap 11073->11074 11075 bf5520 11074->11075 11075->11052 11119 bf49c0 11075->11119 11077 bf554c 11077->11052 11078 be686c RtlFreeHeap 11077->11078 11079 bf5579 11078->11079 11080 bf49c0 RtlAllocateHeap 11079->11080 11081 bf5587 11080->11081 11081->11052 11082 bf4aa8 RtlAllocateHeap 11081->11082 11083 bf55cf 11082->11083 11083->11052 11084 bf4c08 RtlAllocateHeap 11083->11084 11085 bf55e4 11084->11085 11085->11052 11086 be6844 RtlAllocateHeap 11085->11086 11087 bf565b 11086->11087 11087->11052 11088 be6de8 RtlAllocateHeap 11087->11088 11089 bf5673 11088->11089 11089->11052 11090 be6844 RtlAllocateHeap 11089->11090 11091 bf569c 11090->11091 11091->11052 11092 be686c RtlFreeHeap 11091->11092 11092->11052 11094 bf60c8 11093->11094 11095 be6934 RtlAllocateHeap 11094->11095 11098 bf6108 11094->11098 11096 bf60f1 11095->11096 11097 be6934 RtlAllocateHeap 11096->11097 11096->11098 11097->11098 11098->10873 11098->10882 11100 be6844 RtlAllocateHeap 11099->11100 11101 bf4985 11100->11101 11101->10918 11103 be6844 RtlAllocateHeap 11102->11103 11104 bf4a3c 11103->11104 11104->10929 11106 be6844 RtlAllocateHeap 11105->11106 11107 bf4ab8 11106->11107 11107->10935 11109 be6844 RtlAllocateHeap 11108->11109 11111 bf4c27 11109->11111 11110 be6844 RtlAllocateHeap 11110->11111 11111->11110 11112 bf4c54 11111->11112 11112->10938 11112->10944 11114 be6844 RtlAllocateHeap 11113->11114 11115 bf492c 11114->11115 11115->10993 11117 be6844 RtlAllocateHeap 11116->11117 11118 bf48d0 11117->11118 11118->11038 11120 be6844 RtlAllocateHeap 11119->11120 11121 bf49cc 11120->11121 11121->11077 11123 be6844 RtlAllocateHeap 11122->11123 11124 bf3db2 11123->11124 11124->10830 11128 bf2b21 11125->11128 11126 bf2b25 11126->10838 11128->11126 11129 bf2954 11128->11129 11130 bf297b 11129->11130 11131 be97d8 4 API calls 11130->11131 11132 bf298b 11131->11132 11133 bf299f 11132->11133 11134 be97d8 4 API calls 11132->11134 11133->11126 11134->11133 11140 bf66b6 11135->11140 11136 bf6ba4 11138 bf6bb2 11136->11138 11139 be686c RtlFreeHeap 11136->11139 11137 be686c RtlFreeHeap 11137->11136 11138->9876 11139->11138 11141 be6de8 RtlAllocateHeap 11140->11141 11144 bf6714 11140->11144 11142 bf67ec 11141->11142 11143 be6844 RtlAllocateHeap 11142->11143 11142->11144 11143->11144 11144->11136 11144->11137 11146 bf37a7 11145->11146 11147 bf2af8 4 API calls 11146->11147 11162 bf37ab 11146->11162 11148 bf37c2 11147->11148 11151 be6844 RtlAllocateHeap 11148->11151 11149 bf38e9 11152 be686c RtlFreeHeap 11149->11152 11153 bf38f7 11149->11153 11150 be686c RtlFreeHeap 11150->11149 11155 bf37cc 11151->11155 11152->11153 11154 bf3905 11153->11154 11156 be686c RtlFreeHeap 11153->11156 11154->9883 11157 bef82c 2 API calls 11155->11157 11155->11162 11156->11154 11158 bf37e4 11157->11158 11159 be6844 RtlAllocateHeap 11158->11159 11158->11162 11160 bf3802 11159->11160 11161 be6844 RtlAllocateHeap 11160->11161 11160->11162 11161->11162 11162->11149 11162->11150 11164 bf0350 11163->11164 11165 be6844 RtlAllocateHeap 11164->11165 11166 bf0371 11165->11166 11166->9915 11411 be782a 11412 be782c CoInitialize 11411->11412 11413 be7861 11412->11413 11465 beac68 11466 beac50 11465->11466 11467 beac83 11466->11467 11469 be6894 RtlReAllocateHeap 11466->11469 11472 beac66 11466->11472 11468 be686c RtlFreeHeap 11467->11468 11468->11472 11469->11466 11470 be686c RtlFreeHeap 11471 beadb0 11470->11471 11472->11470 11617 bf3168 11619 bf317f 11617->11619 11618 bf31ce 11619->11618 11620 bf2af8 4 API calls 11619->11620 11620->11618 11621 be8f66 11622 be8f68 RtlAdjustPrivilege 11621->11622 11623 be97d8 4 API calls 11622->11623 11624 be8fa0 11623->11624 11625 be9880 NtClose 11624->11625 11628 be9010 11624->11628 11626 be8fae 11625->11626 11626->11628 11629 be8fb7 NtSetInformationThread 11626->11629 11627 be9035 11628->11627 11630 be8ecc 4 API calls 11628->11630 11629->11628 11631 be8fcb 11629->11631 11630->11627 11632 be8da8 7 API calls 11631->11632 11633 be8fe0 11632->11633 11633->11628 11634 be9880 NtClose 11633->11634 11635 be8fee 11634->11635 11635->11628 11636 be8be0 2 API calls 11635->11636 11636->11628 11167 be8ea2 11172 be8e63 11167->11172 11168 be8eaa CloseServiceHandle 11169 be8eb3 11168->11169 11170 be8eb9 CloseServiceHandle 11169->11170 11171 be8ec2 11169->11171 11170->11171 11172->11168 11172->11169 11423 beaa20 11425 beaa43 11423->11425 11424 beab2f 11425->11424 11426 be6844 RtlAllocateHeap 11425->11426 11427 beab03 11426->11427 11427->11424 11428 be686c RtlFreeHeap 11427->11428 11428->11424 11429 bf0220 11442 bf011d 11429->11442 11430 bf028d 11431 be686c RtlFreeHeap 11430->11431 11433 bf029b 11430->11433 11431->11433 11432 be69e0 RtlAllocateHeap 11432->11442 11434 bf0313 11433->11434 11435 be686c RtlFreeHeap 11433->11435 11436 bf0321 11434->11436 11437 be686c RtlFreeHeap 11434->11437 11435->11434 11438 bf032f 11436->11438 11440 be686c RtlFreeHeap 11436->11440 11437->11436 11439 bef6d8 NtSetInformationThread NtClose 11439->11442 11440->11438 11441 beb3c0 2 API calls 11441->11442 11442->11430 11442->11432 11442->11439 11442->11441 11443 be686c RtlFreeHeap 11442->11443 11443->11442 11354 befedb 11365 befd52 11354->11365 11355 be69e0 RtlAllocateHeap 11355->11365 11356 bef59c NtSetInformationThread NtClose 11356->11365 11357 bef6d8 NtSetInformationThread NtClose 11357->11365 11358 beffdb 11361 beffe9 11358->11361 11362 be686c RtlFreeHeap 11358->11362 11359 beff71 11359->11358 11360 be686c RtlFreeHeap 11359->11360 11360->11358 11363 befff7 11361->11363 11364 be686c RtlFreeHeap 11361->11364 11362->11361 11364->11363 11365->11355 11365->11356 11365->11357 11365->11359 11366 be686c RtlFreeHeap 11365->11366 11367 beb3c0 2 API calls 11365->11367 11366->11365 11367->11365 11637 bf7556 11647 bf752b 11637->11647 11638 bf7624 11640 bf205c 16 API calls 11638->11640 11639 bf7631 11641 bf7637 11639->11641 11642 bf7646 11639->11642 11676 bf762c 11640->11676 11643 be9bb0 14 API calls 11641->11643 11644 bf764c 11642->11644 11645 bf7656 11642->11645 11646 bf763c 11643->11646 11648 bf73ac 27 API calls 11644->11648 11649 bf765c 11645->11649 11650 bf7675 11645->11650 11653 bf1ef4 138 API calls 11646->11653 11647->11638 11647->11639 11648->11676 11654 bf6fa0 5 API calls 11649->11654 11651 bf767b 11650->11651 11652 bf7685 11650->11652 11656 bf390c 5 API calls 11651->11656 11657 bf768b 11652->11657 11658 bf76d8 11652->11658 11653->11676 11655 bf7661 11654->11655 11659 bf6bbc 2 API calls 11655->11659 11656->11676 11662 bf76ba 11657->11662 11666 bf6da8 2 API calls 11657->11666 11660 bf76de 11658->11660 11661 bf76e7 11658->11661 11659->11676 11663 bf6bbc 2 API calls 11660->11663 11664 bea338 2 API calls 11661->11664 11667 bf04b4 13 API calls 11662->11667 11662->11676 11663->11676 11665 bf76f8 11664->11665 11668 bf771c 11665->11668 11670 bea338 2 API calls 11665->11670 11666->11662 11667->11676 11669 bf2428 12 API calls 11668->11669 11669->11676 11671 bf770b 11670->11671 11671->11668 11672 bf7710 11671->11672 11673 be9bb0 14 API calls 11672->11673 11674 bf7715 11673->11674 11675 bf7034 138 API calls 11674->11675 11675->11676 11569 bedf94 11576 bede8f 11569->11576 11570 bedef1 ReadFile 11570->11576 11571 bee0aa WriteFile 11571->11576 11572 bee150 NtClose 11572->11576 11573 be686c RtlFreeHeap 11573->11576 11574 bee031 WriteFile 11574->11576 11575 bedee2 11576->11570 11576->11571 11576->11572 11576->11573 11576->11574 11576->11575 11444 be9811 11445 be9813 11444->11445 11446 be97f9 NtQuerySystemInformation 11445->11446 11447 be982c 11445->11447 11448 be6894 RtlReAllocateHeap 11445->11448 11446->11445 11450 be980f 11446->11450 11449 be686c RtlFreeHeap 11447->11449 11448->11445 11449->11450 11451 be686c RtlFreeHeap 11450->11451 11452 be9872 11451->11452 11197 bed88c 11216 becd04 11197->11216 11200 becedc RtlAllocateHeap 11207 bed8cb 11200->11207 11201 bed8c1 11202 be686c RtlFreeHeap 11201->11202 11204 bed9cc 11201->11204 11202->11204 11203 bed9da 11206 bed9e8 11203->11206 11209 be686c RtlFreeHeap 11203->11209 11204->11203 11205 be686c RtlFreeHeap 11204->11205 11205->11203 11208 bed9f6 11206->11208 11210 be686c RtlFreeHeap 11206->11210 11207->11201 11211 be6de8 RtlAllocateHeap 11207->11211 11209->11206 11210->11208 11212 bed921 11211->11212 11212->11201 11213 be6844 RtlAllocateHeap 11212->11213 11214 bed974 11213->11214 11214->11201 11215 becfcc 2 API calls 11214->11215 11215->11201 11217 be6de8 RtlAllocateHeap 11216->11217 11218 becd56 11217->11218 11250 becd5f 11218->11250 11251 bec658 11218->11251 11220 bece70 11223 bece7e 11220->11223 11225 be686c RtlFreeHeap 11220->11225 11222 be686c RtlFreeHeap 11222->11220 11226 bece8c 11223->11226 11228 be686c RtlFreeHeap 11223->11228 11225->11223 11229 bece9a 11226->11229 11231 be686c RtlFreeHeap 11226->11231 11228->11226 11232 becea8 11229->11232 11236 be686c RtlFreeHeap 11229->11236 11230 bec8c4 2 API calls 11233 becd79 11230->11233 11231->11229 11235 beceb6 11232->11235 11238 be686c RtlFreeHeap 11232->11238 11286 bec928 11233->11286 11239 becec4 11235->11239 11240 be686c RtlFreeHeap 11235->11240 11236->11232 11237 becd81 11291 becb20 11237->11291 11238->11235 11241 beced2 11239->11241 11242 be686c RtlFreeHeap 11239->11242 11240->11239 11241->11200 11241->11201 11242->11241 11246 becd99 11247 be6844 RtlAllocateHeap 11246->11247 11248 bece19 11247->11248 11249 be6894 RtlReAllocateHeap 11248->11249 11248->11250 11249->11250 11250->11220 11250->11222 11252 bea488 6 API calls 11251->11252 11253 bec68c 11252->11253 11254 bec692 11253->11254 11255 be6844 RtlAllocateHeap 11253->11255 11256 bec832 11254->11256 11258 be686c RtlFreeHeap 11254->11258 11257 bec6a4 11255->11257 11259 bec840 11256->11259 11261 be686c RtlFreeHeap 11256->11261 11257->11254 11260 bea488 6 API calls 11257->11260 11258->11256 11262 bec84e 11259->11262 11264 be686c RtlFreeHeap 11259->11264 11263 bec6c1 11260->11263 11261->11259 11277 bec858 11262->11277 11263->11254 11265 be6de8 RtlAllocateHeap 11263->11265 11264->11262 11266 bec6d6 11265->11266 11266->11254 11267 be6de8 RtlAllocateHeap 11266->11267 11268 bec6ee 11267->11268 11268->11254 11269 be6844 RtlAllocateHeap 11268->11269 11270 bec71f 11269->11270 11270->11254 11271 be6844 RtlAllocateHeap 11270->11271 11276 bec748 11271->11276 11272 bea1c0 6 API calls 11272->11276 11274 bec7ff 11275 be6894 RtlReAllocateHeap 11274->11275 11275->11254 11276->11254 11276->11272 11276->11274 11298 bea54c 11276->11298 11302 bea108 11277->11302 11280 be6844 RtlAllocateHeap 11281 bec88d 11280->11281 11282 bec8b4 11281->11282 11283 bea108 2 API calls 11281->11283 11282->11230 11284 bec8a8 11283->11284 11284->11282 11285 be686c RtlFreeHeap 11284->11285 11285->11282 11287 be6c98 2 API calls 11286->11287 11290 bec951 11287->11290 11288 be6844 RtlAllocateHeap 11289 bec955 11288->11289 11289->11237 11290->11288 11290->11289 11292 becbdb 11291->11292 11293 be6844 RtlAllocateHeap 11292->11293 11294 becc88 11292->11294 11293->11294 11295 beccb4 11294->11295 11296 be6844 RtlAllocateHeap 11295->11296 11297 beccc6 11296->11297 11297->11246 11299 bea58f 11298->11299 11300 beb3c0 2 API calls 11299->11300 11301 bea5a9 11299->11301 11300->11301 11301->11276 11303 bea13f 11302->11303 11304 bea159 11303->11304 11305 beb3c0 2 API calls 11303->11305 11304->11280 11305->11304 11376 be96cd 11377 be96af 11376->11377 11378 be9735 11377->11378 11379 be686c RtlFreeHeap 11377->11379 11379->11378 11306 bed88a 11307 bed88c 11306->11307 11308 becd04 14 API calls 11307->11308 11309 bed8b8 11308->11309 11310 becedc RtlAllocateHeap 11309->11310 11324 bed8c1 11309->11324 11316 bed8cb 11310->11316 11311 bed9cc 11313 bed9da 11311->11313 11314 be686c RtlFreeHeap 11311->11314 11312 be686c RtlFreeHeap 11312->11311 11315 bed9e8 11313->11315 11318 be686c RtlFreeHeap 11313->11318 11314->11313 11317 bed9f6 11315->11317 11319 be686c RtlFreeHeap 11315->11319 11320 be6de8 RtlAllocateHeap 11316->11320 11316->11324 11318->11315 11319->11317 11321 bed921 11320->11321 11322 be6844 RtlAllocateHeap 11321->11322 11321->11324 11323 bed974 11322->11323 11323->11324 11325 becfcc 2 API calls 11323->11325 11324->11311 11324->11312 11325->11324 11326 be7e8a 11332 be7e60 11326->11332 11327 be7e72 NtQuerySystemInformation 11327->11332 11328 be686c RtlFreeHeap 11328->11332 11329 be6894 RtlReAllocateHeap 11329->11332 11330 be686c RtlFreeHeap 11331 be7f40 Sleep 11330->11331 11331->11332 11332->11327 11332->11328 11332->11329 11332->11330 11333 be6844 RtlAllocateHeap 11332->11333 11333->11332 11592 beddca 11593 bedd81 11592->11593 11596 be6894 RtlReAllocateHeap 11593->11596 11598 bedd9d 11593->11598 11594 beddf0 11595 bede3d 11594->11595 11597 be686c RtlFreeHeap 11594->11597 11596->11593 11597->11595 11598->11594 11599 bedb90 NtTerminateProcess 11598->11599 11600 bedc60 NtTerminateProcess 11598->11600 11599->11598 11600->11598 11380 beb6c8 11381 beb715 11380->11381 11382 beb71c RtlAdjustPrivilege 11381->11382 11383 beb71a 11381->11383 11382->11381 11382->11383

                                                                                                                                                                Executed Functions

                                                                                                                                                                Function 00BF04B4 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 342COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 9 bf04b4-bf0569 call be164c call be6de8 18 bf056b 9->18 19 bf0570-bf0589 call be6844 9->19 20 bf08e9-bf08f0 18->20 27 bf058b 19->27 28 bf0590-bf05a3 call bf8c34 19->28 22 bf08fe-bf0905 20->22 23 bf08f2 20->23 25 bf0907 22->25 26 bf0913-bf0917 22->26 23->22 25->26 30 bf0919 26->30 31 bf0922-bf0926 26->31 27->20 35 bf05aa-bf05ba call bf0338 28->35 36 bf05a5 28->36 30->31 33 bf0928-bf092b call be686c 31->33 34 bf0930-bf0934 31->34 33->34 38 bf093e-bf0942 34->38 39 bf0936-bf0939 call be686c 34->39 48 bf05bc 35->48 49 bf05c1-bf0612 GetTempFileNameW CreateFileW 35->49 36->20 42 bf094c-bf0950 38->42 43 bf0944-bf0947 call be686c 38->43 39->38 46 bf095a-bf0960 42->46 47 bf0952-bf0955 call be686c 42->47 43->42 47->46 48->20 52 bf0619-bf062e WriteFile 49->52 53 bf0614 49->53 54 bf0635-bf064e 52->54 55 bf0630 52->55 53->20 57 bf0650-bf0655 54->57 55->20 58 bf0659-bf065b 57->58 59 bf0657-bf0698 CreateProcessW 57->59 58->57 61 bf069f-bf06bc NtQueryInformationProcess 59->61 62 bf069a 59->62 63 bf06be 61->63 64 bf06c3-bf06e3 NtReadVirtualMemory 61->64 62->20 63->20 65 bf06ea-bf06fb call be6de8 64->65 66 bf06e5 64->66 69 bf06fd 65->69 70 bf0702-bf077d call bf92f4 call bf9348 call bf941c NtProtectVirtualMemory 65->70 66->20 69->20 77 bf077f 70->77 78 bf0784-bf0797 NtWriteVirtualMemory 70->78 77->20 79 bf079e-bf07fa 78->79 80 bf0799 78->80 82 bf07fc 79->82 83 bf0801-bf0822 79->83 80->20 82->20 85 bf0829-bf0891 CreateNamedPipeW 83->85 86 bf0824 83->86 87 bf0895-bf08ae ResumeThread ConnectNamedPipe 85->87 88 bf0893 85->88 86->20 89 bf08bf-bf08dc 87->89 90 bf08b0-bf08bb 87->90 88->20 93 bf08de 89->93 94 bf08e0 89->94 90->89 91 bf08bd 90->91 91->20 93->20 94->20
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID: D
                                                                                                                                                                • API String ID: 0-2746444292
                                                                                                                                                                • Opcode ID: 3a99a1bc2914888dbd01932e49a88b86f5b36e042cf992393dd344703bfb6a0c
                                                                                                                                                                • Instruction ID: 2fb07efdbcfa7121d57a92e6f7ad8a3e5c0c809c93bace741d5cb68f3e0a9cd5
                                                                                                                                                                • Opcode Fuzzy Hash: 3a99a1bc2914888dbd01932e49a88b86f5b36e042cf992393dd344703bfb6a0c
                                                                                                                                                                • Instruction Fuzzy Hash: 38E11A7191021CEFEF20AF90DC49BEEBBB9FB04305F1040A5E609A61A1D7755A98DF91
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE91C8 Relevance: 18.2, APIs: 12, Instructions: 241registryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 95 be91c8-be949b call be1240 * 5 RegCreateKeyExW 106 be957d-be9581 95->106 107 be94a1 95->107 109 be958c-be95ba RegCreateKeyExW 106->109 110 be9583 106->110 108 be94a8-be94c5 RegEnumKeyW 107->108 113 be94cc-be94f8 RegCreateKeyExW 108->113 114 be94c7 108->114 111 be95bc 109->111 112 be9615-be9619 109->112 110->109 115 be95c3-be95e0 RegEnumKeyW 111->115 118 be961b 112->118 119 be9624-be9627 112->119 116 be94fa-be951a RegSetValueExW 113->116 117 be9575-be9578 113->117 114->106 120 be95e4-be95fa OpenEventLogW 115->120 121 be95e2 115->121 122 be951c-be9538 RegSetValueExW 116->122 123 be9566-be956a 116->123 117->108 118->119 124 be95fc-be9607 ClearEventLogW 120->124 125 be9610-be9613 120->125 121->112 122->123 126 be953a-be9550 OpenEventLogW 122->126 123->117 127 be956c 123->127 124->125 125->115 126->123 128 be9552-be9560 ClearEventLogW CloseEventLog 126->128 127->117 128->123
                                                                                                                                                                APIs
                                                                                                                                                                • RegCreateKeyExW.KERNELBASE(80000002,?,00000000,00000000,00000000,0002011F,00000000,00000000,00000000,?,00000007,?,00000004,?,00000019,?), ref: 00BE9493
                                                                                                                                                                • RegEnumKeyW.ADVAPI32(00000000,00000000,?,00000104), ref: 00BE94BA
                                                                                                                                                                • RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,0002011F,00000000,00000000,00000000), ref: 00BE94F0
                                                                                                                                                                • RegSetValueExW.KERNELBASE(00000000,?,00000000,00000004,00000000,00000004), ref: 00BE9512
                                                                                                                                                                • RegSetValueExW.KERNELBASE(00000000,?,00000000,00000001,?,00000064), ref: 00BE9530
                                                                                                                                                                • OpenEventLogW.ADVAPI32(00000000,?), ref: 00BE9543
                                                                                                                                                                • ClearEventLogW.ADVAPI32(00000000,00000000), ref: 00BE9557
                                                                                                                                                                • CloseEventLog.ADVAPI32(00000000), ref: 00BE9560
                                                                                                                                                                • RegCreateKeyExW.KERNELBASE(80000002,?,00000000,00000000,00000000,0002011F,00000000,00000000,00000000), ref: 00BE95B2
                                                                                                                                                                • RegEnumKeyW.ADVAPI32(00000000,00000000,?,00000104), ref: 00BE95D5
                                                                                                                                                                • OpenEventLogW.ADVAPI32(00000000,?), ref: 00BE95ED
                                                                                                                                                                • ClearEventLogW.ADVAPI32(00000000,00000000), ref: 00BE9601
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Event$Create$ClearEnumOpenValue$Close
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3255277317-0
                                                                                                                                                                • Opcode ID: cd6710162464aefcbd97e6b9b4e38c886b5b14759e4286ad90963449c2942a25
                                                                                                                                                                • Instruction ID: 159ed6025b38f93cf6e644f29b22e9735e68c6bccb9836a7f2eb9eb43c0fd099
                                                                                                                                                                • Opcode Fuzzy Hash: cd6710162464aefcbd97e6b9b4e38c886b5b14759e4286ad90963449c2942a25
                                                                                                                                                                • Instruction Fuzzy Hash: FBC1F5B884030AEFDB208F51D849B997BB8FF04744F5281C9E6146F2B2D77A9A44CF56
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BEA68C Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 190fileCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 267 bea68c-bea70c GetVolumeNameForVolumeMountPointW FindFirstVolumeW 271 bea712-bea718 267->271 272 bea950-bea955 267->272 273 bea71e-bea725 271->273 274 bea91f-bea941 271->274 273->274 275 bea72b-bea742 GetVolumePathNamesForVolumeNameW 273->275 274->271 281 bea947-bea94a FindVolumeClose 274->281 275->274 277 bea748-bea74c 275->277 277->274 278 bea752-bea756 277->278 278->274 280 bea75c-bea766 GetDriveTypeW 278->280 282 bea768-bea76b 280->282 283 bea771-bea779 call be1564 280->283 281->272 282->274 282->283 286 bea77b-bea7c3 283->286 287 bea7f7-bea81d call be16f0 CreateFileW 283->287 297 bea7c5-bea7de call bea600 286->297 298 bea7e3-bea7e7 286->298 291 bea916 287->291 292 bea823-bea849 DeviceIoControl 287->292 291->274 292->291 293 bea84f-bea856 292->293 295 bea8bc-bea8c3 293->295 296 bea858-bea864 293->296 295->291 299 bea8c5-bea8cc 295->299 300 bea866-bea86d 296->300 301 bea883-bea889 296->301 297->298 302 bea7e9 298->302 303 bea7f2 298->303 299->291 304 bea8ce-bea8d5 299->304 300->301 305 bea86f-bea876 300->305 307 bea88b-bea892 301->307 308 bea8a8-bea8b5 call be16c0 call bea600 301->308 302->303 303->274 304->291 309 bea8d7-bea8f1 call be16c0 304->309 305->301 310 bea878-bea87f 305->310 307->308 312 bea894-bea89b 307->312 320 bea8ba 308->320 323 bea90a-bea911 call bea600 309->323 324 bea8f3-bea8fa 309->324 310->301 316 bea881 310->316 312->308 317 bea89d-bea8a4 312->317 316->320 317->308 321 bea8a6 317->321 320->291 321->320 323->291 326 bea8fc-bea903 call bea600 324->326 327 bea908 324->327 326->327 327->291
                                                                                                                                                                APIs
                                                                                                                                                                • GetVolumeNameForVolumeMountPointW.KERNELBASE(?,?,00000104), ref: 00BEA6D6
                                                                                                                                                                • FindFirstVolumeW.KERNELBASE(?,00000104), ref: 00BEA6FF
                                                                                                                                                                • GetVolumePathNamesForVolumeNameW.KERNELBASE(?,?,00000040,00000000), ref: 00BEA73A
                                                                                                                                                                • GetDriveTypeW.KERNELBASE(?), ref: 00BEA75D
                                                                                                                                                                • CreateFileW.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?), ref: 00BEA810
                                                                                                                                                                • DeviceIoControl.KERNELBASE(000000FF,00070048,00000000,00000000,?,00000090,00000001,00000000), ref: 00BEA841
                                                                                                                                                                • FindVolumeClose.KERNELBASE(00000000), ref: 00BEA94A
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Volume$FindName$CloseControlCreateDeviceDriveFileFirstMountNamesPathPointType
                                                                                                                                                                • String ID: '
                                                                                                                                                                • API String ID: 433347348-1997036262
                                                                                                                                                                • Opcode ID: 3644d352a1e47e32ec7fb8899b972fb519f44f5eea2dd8c04b0248bd6c1338c0
                                                                                                                                                                • Instruction ID: f45e62bce8dbeed08fa13a18ce67f5419902a10e4a8134c755847754a0edc627
                                                                                                                                                                • Opcode Fuzzy Hash: 3644d352a1e47e32ec7fb8899b972fb519f44f5eea2dd8c04b0248bd6c1338c0
                                                                                                                                                                • Instruction Fuzzy Hash: BE71AC30800658EFEF309B52DC09B9EBBFCEF11312F1680D5E205A60A2D7746A85CF66
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BEC3F8 Relevance: 12.2, APIs: 8, Instructions: 173registryfilenativeCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 329 bec3f8-bec412 330 bec64b-bec654 329->330 331 bec418-bec42d call be6de8 329->331 331->330 334 bec433-bec449 call be6844 331->334 337 bec44f-bec460 call bf8c34 334->337 338 bec645-bec646 call be686c 334->338 342 bec63f-bec640 call be686c 337->342 343 bec466-bec4e7 call be16c0 CreateFileW 337->343 338->330 342->338 343->342 349 bec4ed-bec502 WriteFile 343->349 350 bec508-bec52b RegCreateKeyExW 349->350 351 bec636 349->351 350->351 352 bec531-bec55d RegSetValueExW 350->352 351->342 354 bec62d-bec630 NtClose 352->354 355 bec563-bec5dc RegCreateKeyExW 352->355 354->351 355->354 358 bec5de-bec610 RegSetValueExW 355->358 358->354 360 bec612-bec626 SHChangeNotify 358->360 360->354
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00BE6844: RtlAllocateHeap.NTDLL(?,00000008,00000000,?,00BF7764,?,00000000,00000000), ref: 00BE6860
                                                                                                                                                                • CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00BEC4DA
                                                                                                                                                                • WriteFile.KERNELBASE(000000FF,00000000,000000FF,?,00000000), ref: 00BEC4FA
                                                                                                                                                                • RegCreateKeyExW.KERNELBASE(80000000,?,00000000,00000000,00000000,00020106,00000000,?,00000000), ref: 00BEC523
                                                                                                                                                                • RegSetValueExW.KERNELBASE(?,00000000,00000000,00000001,?,00000000), ref: 00BEC555
                                                                                                                                                                • RegCreateKeyExW.KERNELBASE(80000000,?,00000000,00000000,00000000,00020106,00000000,?,00000000), ref: 00BEC5D4
                                                                                                                                                                • RegSetValueExW.KERNELBASE(?,00000000,00000000,00000001,?,00000000), ref: 00BEC608
                                                                                                                                                                • SHChangeNotify.SHELL32(08000000,00001000,00000000,00000000), ref: 00BEC620
                                                                                                                                                                • NtClose.NTDLL(?), ref: 00BEC630
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Create$FileValue$AllocateChangeCloseHeapNotifyWrite
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1108940941-0
                                                                                                                                                                • Opcode ID: 51a48b5ebfa3dd6ead5f0e90cc459ddea96f352e4a371be9f72a05ae5b802e52
                                                                                                                                                                • Instruction ID: 8c8088a57d7409bd859d58e226951011b61d17114d29ca54bc25e44fad51caf6
                                                                                                                                                                • Opcode Fuzzy Hash: 51a48b5ebfa3dd6ead5f0e90cc459ddea96f352e4a371be9f72a05ae5b802e52
                                                                                                                                                                • Instruction Fuzzy Hash: 83516F71A00609BFEB209FA5DC49FAF7BB8FB00705F504164F604AA190D7B19A55CFA4
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BF7034 Relevance: 10.7, APIs: 7, Instructions: 248threadnativeCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 361 bf7034-bf7053 363 bf7059-bf7060 361->363 364 bf7111-bf7118 361->364 367 bf708b-bf7092 363->367 368 bf7062-bf7088 call be6ae8 363->368 365 bf711a-bf7133 CreateThread 364->365 366 bf7145-bf717c CreateThread * 2 364->366 365->366 371 bf7135-bf713e 365->371 372 bf717e call be7ca4 366->372 373 bf7183-bf718a 366->373 369 bf70ce-bf70d5 367->369 370 bf7094-bf709b 367->370 368->367 369->364 376 bf70d7-bf70de 369->376 370->369 374 bf709d-bf70c7 call be9c64 370->374 371->366 372->373 377 bf718c-bf71a1 CreateThread 373->377 378 bf71a4-bf71ab 373->378 374->369 376->364 382 bf70e0-bf710a call be9c64 376->382 377->378 383 bf71ad-bf71b4 378->383 384 bf71b6-bf71dd call beb734 call bee1e8 378->384 382->364 383->384 387 bf722e-bf7232 383->387 411 bf71df-bf71e6 384->411 412 bf7221-bf7225 384->412 391 bf7248-bf724c 387->391 392 bf7234-bf723f 387->392 396 bf724e-bf7259 391->396 397 bf7262-bf7269 391->397 392->391 396->397 401 bf727f-bf7286 397->401 402 bf726b-bf7276 NtTerminateThread 397->402 406 bf7288-bf72a1 CreateThread 401->406 407 bf72b3-bf72bd 401->407 402->401 406->407 409 bf72a3-bf72ac 406->409 413 bf72c3-bf72ca 407->413 414 bf7392-bf73a0 call bf1934 call bf1d28 call bf16ac 407->414 409->407 415 bf71e8-bf71fc call bea68c call bee2b8 call bf0a38 call bee2b8 call bf0be4 411->415 416 bf7201-bf7208 411->416 412->387 420 bf72cc-bf72e5 CreateThread 413->420 421 bf72f7-bf72fe 413->421 452 bf73a5-bf73a9 414->452 415->416 418 bf720a-bf720f call bee2b8 call befc88 416->418 419 bf7214-bf721c call bee270 call bee2b8 416->419 418->419 419->412 420->421 425 bf72e7-bf72f0 420->425 428 bf7339-bf7340 call beb674 421->428 429 bf7300-bf7304 421->429 425->421 445 bf7349-bf734b call be8230 428->445 446 bf7342-bf7347 call be8960 428->446 435 bf731a-bf7334 call be6ae8 call beda00 429->435 436 bf7306-bf7311 429->436 435->428 436->435 457 bf7350-bf7357 445->457 446->457 460 bf736b-bf738b call be9640 call bf04b4 457->460 461 bf7359-bf7360 457->461 467 bf7390 460->467 461->460 465 bf7362-bf7369 461->465 465->460 465->467 467->452
                                                                                                                                                                APIs
                                                                                                                                                                • CreateThread.KERNELBASE(00000000,00000000,00BE8F68,00000000,00000000,00000000), ref: 00BF7129
                                                                                                                                                                • CreateThread.KERNELBASE(00000000,00000000,00BE7468,00000000,00000000,00000000), ref: 00BF7154
                                                                                                                                                                • CreateThread.KERNELBASE(00000000,00000000,00BE782C,00000000,00000000,00000000), ref: 00BF716C
                                                                                                                                                                • CreateThread.KERNELBASE(00000000,00000000,00BE7E58,00000000,00000000,00000000), ref: 00BF719B
                                                                                                                                                                • NtTerminateThread.NTDLL(?,00000000), ref: 00BF7270
                                                                                                                                                                • CreateThread.KERNELBASE(00000000,00000000,00BE9628,00000000,00000000,00000000), ref: 00BF7297
                                                                                                                                                                • CreateThread.KERNELBASE(00000000,00000000,00BEC064,00000000,00000000,00000000), ref: 00BF72DB
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Thread$Create$Terminate
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1922322686-0
                                                                                                                                                                • Opcode ID: 23bd258c16dd8d60b6b027b4a4a90741c0fbdc971542a761f8d0ad6f3113d961
                                                                                                                                                                • Instruction ID: 55cf99157fbdae9385a462d469f609d6a3c97d353a464dd5e9953803e3e55ec3
                                                                                                                                                                • Opcode Fuzzy Hash: 23bd258c16dd8d60b6b027b4a4a90741c0fbdc971542a761f8d0ad6f3113d961
                                                                                                                                                                • Instruction Fuzzy Hash: 89919F70688748BFEB216BB49C4EBAE3AF5AB05706F2501D4F311A51F2CBB44984DF25
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE6668 Relevance: 9.2, APIs: 6, Instructions: 161filenativememoryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 520 be6668-be667b 521 be667e-be6683 520->521 521->521 522 be6685-be6699 call bea094 521->522 525 be669b-be669f 522->525 526 be66a5-be66c7 CreateFileW 522->526 525->526 527 be67ca-be67cc 525->527 526->527 528 be66cd-be66cf 526->528 530 be67cf-be67d2 527->530 529 be66d2-be66fb NtAllocateVirtualMemory 528->529 533 be66fd-be6708 529->533 534 be6703 529->534 531 be67d4-be67ed NtFreeVirtualMemory 530->531 532 be67f3-be67f7 530->532 531->532 532->530 535 be67f9-be67fd 532->535 541 be670a-be6719 533->541 542 be671b-be671e 533->542 537 be6733-be6738 534->537 539 be67ff 535->539 540 be6808-be681f call be6550 DeleteFileW 535->540 538 be673b-be6746 537->538 543 be6748-be6752 538->543 544 be6754 538->544 539->540 552 be6828-be682c 540->552 553 be6821 540->553 546 be672d-be6731 541->546 542->546 547 be6720-be6728 call be6628 542->547 548 be6759-be6760 543->548 544->548 546->529 546->537 547->546 551 be6763-be6779 WriteFile 548->551 554 be677d-be679a SetFilePointerEx 551->554 555 be677b 551->555 556 be682e-be6831 call be686c 552->556 557 be6836-be683f 552->557 553->552 554->551 558 be679c-be67a3 554->558 555->558 556->557 560 be67a7-be67c5 558->560 561 be67a5 558->561 560->538 561->527
                                                                                                                                                                APIs
                                                                                                                                                                • CreateFileW.KERNELBASE(00BE77D6,40000000,00000003,00000000,00000003,80000000,00000000,00BE77D6,?,?,00000000,?), ref: 00BE66BA
                                                                                                                                                                • NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00010000,00001000,00000004,?,00000000,?), ref: 00BE66F3
                                                                                                                                                                • WriteFile.KERNELBASE(000000FF,00000000,00010000,00010000,00000000,?,00000000,?), ref: 00BE6771
                                                                                                                                                                • SetFilePointerEx.KERNELBASE(000000FF,00010000,?,00000000,00000001,?,00000000,?), ref: 00BE678D
                                                                                                                                                                • NtFreeVirtualMemory.NTDLL(000000FF,?,00010000,00008000,?,00000000,?), ref: 00BE67ED
                                                                                                                                                                • DeleteFileW.KERNELBASE(?,000000FF,?,?,00000000,?), ref: 00BE6817
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$MemoryVirtual$AllocateCreateDeleteFreePointerWrite
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 69945773-0
                                                                                                                                                                • Opcode ID: a5530f9c729120fe8498cae39627fe853ec578724d57e030f1b376809fa7ca5e
                                                                                                                                                                • Instruction ID: 9a69950d4864efb4448e545059b30f9c1c79c1efa4075c196b4d0452416751fc
                                                                                                                                                                • Opcode Fuzzy Hash: a5530f9c729120fe8498cae39627fe853ec578724d57e030f1b376809fa7ca5e
                                                                                                                                                                • Instruction Fuzzy Hash: 13515F71900249AFDF11CFA5CC84BEEBBF9EB287A9F200265F911B6090D3B55E85CB51
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BEC28C Relevance: 9.1, APIs: 6, Instructions: 134filenativeCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 563 bec28c-bec2b7 CreateFileW 564 bec3ed-bec3f3 563->564 565 bec2bd-bec2d6 563->565 566 bec2dc-bec2ee call be17ac 565->566 569 bec2f5-bec318 WriteFile 566->569 570 bec32c-bec351 WriteFile 569->570 571 bec31a-bec329 569->571 572 bec365-bec388 WriteFile 570->572 573 bec353-bec362 NtClose 570->573 575 bec39c-bec3c1 WriteFile 572->575 576 bec38a-bec399 572->576 577 bec3d5-bec3e2 575->577 578 bec3c3-bec3d2 575->578 577->569 580 bec3e8 577->580 580->566
                                                                                                                                                                APIs
                                                                                                                                                                • CreateFileW.KERNELBASE(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,?,00000000), ref: 00BEC2AA
                                                                                                                                                                • WriteFile.KERNELBASE(000000FF,?,00000001,00000000,00000000,00C06000,?,?,?,00000000), ref: 00BEC30B
                                                                                                                                                                • WriteFile.KERNELBASE(000000FF,?,00000001,00000000,00000000,?,?,00000000), ref: 00BEC344
                                                                                                                                                                • NtClose.NTDLL(000000FF,?,?,00000000), ref: 00BEC356
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$Write$CloseCreate
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 237505210-0
                                                                                                                                                                • Opcode ID: 257e1a1226f0d4305f7f6564517d1f6108693dd47db15260951dde54681d5ff5
                                                                                                                                                                • Instruction ID: 85bcb9acb58ddbaf20fd9e5aa9fccd65b6e82557cd328f1f3bb8cee014e393cd
                                                                                                                                                                • Opcode Fuzzy Hash: 257e1a1226f0d4305f7f6564517d1f6108693dd47db15260951dde54681d5ff5
                                                                                                                                                                • Instruction Fuzzy Hash: E4412B31A4024CFFDB00DBD5EC45BEEFBBAEB54312F5081A6E604A2191D3714E54DBA5
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BEDE78 Relevance: 7.8, APIs: 5, Instructions: 256filethreadCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 582 bede78-bede89 SetThreadPriority 583 bede8f-bedeae 582->583 585 bedede-bedee0 583->585 586 bedeb0-bedeb8 583->586 587 bedee6-bedeeb 585->587 588 bedee2-bedee5 585->588 586->585 589 bedeba 586->589 590 bedfa0-bedfa3 587->590 591 bedef1-bedf23 ReadFile 587->591 592 bedec1-beded6 589->592 593 bedfa9-bedfee call be20ac 590->593 594 bee0a1-bee0a4 590->594 595 bedf96 591->595 596 bedf25-bedf30 591->596 608 bededa 592->608 609 beded8-bededc 592->609 640 bee007-bee00f 593->640 641 bedff0-bee005 593->641 599 bee0aa-bee0e9 WriteFile 594->599 600 bee131-bee134 594->600 597 bee180-bee19f 595->597 596->595 598 bedf32-bedf3a 596->598 622 bee1a3-bee1ab 597->622 623 bee1a1 597->623 603 bedf3c-bedf56 598->603 604 bedf58-bedf7f 598->604 606 bee12d 599->606 607 bee0eb-bee0f6 599->607 600->597 605 bee136-bee13a 600->605 603->595 636 bedf92 604->636 637 bedf81-bedf8c 604->637 612 bee13c-bee142 605->612 613 bee150-bee16e NtClose call be1074 call be686c 605->613 606->597 607->606 615 bee0f8-bee116 607->615 608->592 609->583 618 bee146-bee14e 612->618 619 bee144 612->619 638 bee173-bee17e 613->638 645 bee118-bee123 615->645 646 bee129 615->646 618->612 619->613 626 bee1ad 622->626 627 bee1d1 622->627 625 bee1d3-bee1d5 623->625 630 bee1db 625->630 631 bee1d7-bee1da 625->631 632 bee1b4-bee1c9 626->632 627->597 627->625 630->587 654 bee1cd 632->654 655 bee1cb-bee1cf 632->655 636->595 642 bedf8e 637->642 643 bedf90 637->643 638->597 659 bee1e0 638->659 648 bee01e-bee02a 640->648 649 bee011-bee013 640->649 647 bee031-bee04d WriteFile 641->647 642->595 643->604 656 bee127 645->656 657 bee125 645->657 646->606 651 bee04f-bee05a 647->651 652 bee097 647->652 648->647 649->648 650 bee015-bee01c 649->650 650->647 651->652 658 bee05c-bee080 651->658 652->597 654->632 655->597 656->615 657->606 663 bee082-bee08d 658->663 664 bee093 658->664 659->583 665 bee08f 663->665 666 bee091 663->666 664->652 665->652 666->658
                                                                                                                                                                APIs
                                                                                                                                                                • SetThreadPriority.KERNELBASE(000000FE,00000002), ref: 00BEDE89
                                                                                                                                                                • ReadFile.KERNELBASE(?,?,?,?,?), ref: 00BEDF1B
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FilePriorityReadThread
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3643687941-0
                                                                                                                                                                • Opcode ID: 2b02a199f54d46e2df1ff3ea15051089aa85c960753db37554ccb77b740ddcff
                                                                                                                                                                • Instruction ID: 3f034aa9798aa54c8b4600f612c79d830d664e663bdf2642dc2bf3f5fd5e9174
                                                                                                                                                                • Opcode Fuzzy Hash: 2b02a199f54d46e2df1ff3ea15051089aa85c960753db37554ccb77b740ddcff
                                                                                                                                                                • Instruction Fuzzy Hash: A0A16E71500688EFDF21CF91CCC9BAA3BFCEB08714F2042A6E91599196D7B4DA84DF52
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BEF308 Relevance: 7.7, APIs: 5, Instructions: 175filethreadCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 667 bef308-bef31f GetFileAttributesW 668 bef37f-bef391 SetThreadPriority call be1564 667->668 669 bef321-bef32d call bebbf4 667->669 676 bef39c 668->676 677 bef393-bef39a 668->677 674 bef32f-bef33d call bea094 669->674 675 bef371-bef37c call be686c 669->675 674->675 684 bef33f-bef343 674->684 679 bef3a3-bef3b6 call be6844 676->679 677->679 688 bef3bd-bef3fd call bec19c call bef164 call be686c FindFirstFileExW 679->688 686 bef34b-bef36e call bec19c call be7290 call beef6c 684->686 687 bef345-bef349 684->687 687->675 687->686 701 bef535-bef54a call be686c 688->701 702 bef403-bef411 688->702 706 bef54e-bef562 701->706 707 bef54c-bef56a call be686c 701->707 708 bef416-bef41f 702->708 706->688 715 bef56f-bef572 707->715 710 bef429 708->710 711 bef421-bef427 708->711 714 bef514-bef526 FindNextFileW 710->714 711->710 713 bef42e-bef438 711->713 716 bef43f-bef446 713->716 717 bef43a 713->717 714->708 718 bef52c-bef52f FindClose 714->718 719 bef448-bef44c 716->719 720 bef453-bef457 716->720 717->714 718->701 719->720 721 bef44e 719->721 722 bef459-bef461 call bef2b4 720->722 723 bef481-bef489 call bef21c 720->723 721->714 730 bef47c 722->730 731 bef463-bef467 call bef1c8 722->731 728 bef48b 723->728 729 bef490-bef497 723->729 728->714 733 bef499-bef4a0 729->733 734 bef4a4-bef4ae call bebbf4 729->734 730->714 735 bef46c-bef47a 731->735 733->734 736 bef4a2 733->736 739 bef4b2-bef4d0 call bef1c8 call be7290 call beef6c 734->739 740 bef4b0 734->740 735->730 736->714 746 bef4d5-bef4dc 739->746 740->714 746->714 747 bef4de-bef4e0 746->747 748 bef509 747->748 749 bef4e2-bef507 747->749 748->714 749->714
                                                                                                                                                                APIs
                                                                                                                                                                • GetFileAttributesW.KERNELBASE(?), ref: 00BEF314
                                                                                                                                                                • SetThreadPriority.KERNELBASE(000000FE,00000002), ref: 00BEF383
                                                                                                                                                                • FindFirstFileExW.KERNELBASE(?,00000000,?,00000000,00000000,00000000,?,?,?,00C05180,003D0900), ref: 00BEF3F0
                                                                                                                                                                • FindNextFileW.KERNELBASE(000000FF,?), ref: 00BEF51E
                                                                                                                                                                • FindClose.KERNELBASE(000000FF), ref: 00BEF52F
                                                                                                                                                                  • Part of subcall function 00BEA094: FindFirstFileExW.KERNELBASE(?,00000000,?,00000000,00000000,00000000), ref: 00BEA0B6
                                                                                                                                                                  • Part of subcall function 00BEA094: FindClose.KERNELBASE(000000FF), ref: 00BEA0DC
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Find$File$CloseFirst$AttributesNextPriorityThread
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3755735135-0
                                                                                                                                                                • Opcode ID: 89048be8673471af002f3d1b809f860d4e79432db29ab737eb4d840030e28438
                                                                                                                                                                • Instruction ID: 3beb109412b70a2b52bc213838a4eacde9d327c12f261efe4cd87a837c95a52f
                                                                                                                                                                • Opcode Fuzzy Hash: 89048be8673471af002f3d1b809f860d4e79432db29ab737eb4d840030e28438
                                                                                                                                                                • Instruction Fuzzy Hash: 6D61783080068AEBDF21AFA2DC49BBEBBF5EF11310F1041F5E914651A2D7319A91DF95
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE766C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 119fileCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 751 be766c-be7693 753 be7699-be76ad call be6844 751->753 754 be7822-be7827 751->754 757 be7806-be780a 753->757 758 be76b3-be7700 call be16c0 FindFirstFileExW 753->758 759 be780c-be780f call be686c 757->759 760 be7814-be7818 757->760 758->757 768 be7706-be770f 758->768 759->760 760->754 762 be781a-be781d call be686c 760->762 762->754 769 be77e5-be77f7 FindNextFileW 768->769 770 be7715-be771b 768->770 769->768 772 be77fd 769->772 770->769 771 be7721-be774f call be6844 770->771 771->769 777 be7755-be7791 GetFileAttributesW 771->777 772->757 781 be77ce-be77d1 call be6668 777->781 782 be7793-be779e 777->782 784 be77d6-be77de call be686c 781->784 787 be77a2-be77ad 782->787 788 be77a0 782->788 784->769 791 be77af-be77bb call be766c 787->791 792 be77b9 787->792 790 be77bd-be77cc call be686c 788->790 790->769 791->782 792->790
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00BE6844: RtlAllocateHeap.NTDLL(?,00000008,00000000,?,00BF7764,?,00000000,00000000), ref: 00BE6860
                                                                                                                                                                • FindFirstFileExW.KERNELBASE(00000000,00000000,?,00000000,00000000,00000000), ref: 00BE76F3
                                                                                                                                                                • GetFileAttributesW.KERNELBASE(00000000), ref: 00BE7786
                                                                                                                                                                • FindNextFileW.KERNELBASE(000000FF,?), ref: 00BE77EF
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$Find$AllocateAttributesFirstHeapNext
                                                                                                                                                                • String ID: *
                                                                                                                                                                • API String ID: 2400493143-163128923
                                                                                                                                                                • Opcode ID: d1f1949899918e9e30fac668b01edbcd074c14da949dfeb939047e739e572236
                                                                                                                                                                • Instruction ID: 32f00a58b3c08a9d180deb1bc19019d0fc185c9b4359f82d0a94448740761746
                                                                                                                                                                • Opcode Fuzzy Hash: d1f1949899918e9e30fac668b01edbcd074c14da949dfeb939047e739e572236
                                                                                                                                                                • Instruction Fuzzy Hash: 8B416970C44158EBDF119FA2DC4DBAEBBB5FF10306F0044A1E412A10A1EB764E64EF51
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE5C24 Relevance: 6.1, APIs: 4, Instructions: 99fileCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 798 be5c24-be5c35 799 be5c56-be5c5d 798->799 800 be5c37-be5c51 call be5aec 798->800 802 be5c7e-be5c85 799->802 803 be5c5f-be5c79 call be5aec 799->803 800->799 806 be5ca6-be5cad call be1658 802->806 807 be5c87-be5ca1 call be5aec 802->807 803->802 812 be5cb2-be5cb6 806->812 807->806 813 be5cdd-be5ce0 812->813 814 be5cb8-be5ce2 call be1240 812->814 813->812 818 be5ce9-be5d04 FindFirstFileW 814->818 819 be5d06-be5d17 call be11c4 818->819 820 be5d54-be5d58 818->820 830 be5d19-be5d2b FindClose call be5a20 819->830 831 be5d37-be5d49 FindNextFileW 819->831 822 be5d5c-be5d66 820->822 823 be5d5a-be5d9c 820->823 824 be5d8b-be5d8e 822->824 825 be5d68-be5d6d 822->825 824->818 828 be5d6f-be5d84 call be1240 825->828 829 be5d86-be5d89 825->829 828->824 829->825 836 be5d30-be5d34 830->836 831->819 834 be5d4b-be5d4e FindClose 831->834 834->820
                                                                                                                                                                APIs
                                                                                                                                                                • FindFirstFileW.KERNELBASE(?,?,?,00000004,?), ref: 00BE5CF7
                                                                                                                                                                • FindClose.KERNELBASE(000000FF,?,00000000), ref: 00BE5D1C
                                                                                                                                                                • FindNextFileW.KERNELBASE(000000FF,?,?,00000000), ref: 00BE5D41
                                                                                                                                                                • FindClose.KERNELBASE(000000FF), ref: 00BE5D4E
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Find$CloseFile$FirstNext
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1164774033-0
                                                                                                                                                                • Opcode ID: df499e7afd6733cac789e4ad2dc39bf75ec3c658841b7a623173299735399f19
                                                                                                                                                                • Instruction ID: a8701a6605dab424e986719e75e0338182ec88a179dd7dc5551d29047d51134d
                                                                                                                                                                • Opcode Fuzzy Hash: df499e7afd6733cac789e4ad2dc39bf75ec3c658841b7a623173299735399f19
                                                                                                                                                                • Instruction Fuzzy Hash: D8419F70800B88DFCB309FA5DD89BDE7BB8EB0030AF6091E1E5059A261D77489C5CF51
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BEB734 Relevance: 4.5, APIs: 3, Instructions: 31nativeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • NtSetInformationProcess.NTDLL(000000FF,00000021,00000000,00000004,00000004,00000000,00BF71D1), ref: 00BEB751
                                                                                                                                                                • NtSetInformationProcess.NTDLL(000000FF,00000012,00000000,00000002), ref: 00BEB763
                                                                                                                                                                • NtSetInformationProcess.NTDLL(000000FF,0000000C,00000000,00000004), ref: 00BEB778
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: InformationProcess
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1801817001-0
                                                                                                                                                                • Opcode ID: e1d157458a3e6980cafd2e2d8bcc0ce2d65696d8f75bc0de98edfccd84781ca6
                                                                                                                                                                • Instruction ID: 398f0818cc711bb74041268861e6cf5a8e8908d713576324a832f9c27ebca8bf
                                                                                                                                                                • Opcode Fuzzy Hash: e1d157458a3e6980cafd2e2d8bcc0ce2d65696d8f75bc0de98edfccd84781ca6
                                                                                                                                                                • Instruction Fuzzy Hash: 05F01CB1240661AFEF21ABD4DCC6F6A379C9B05721F1003A1B331DD0E6D7B08444CB52
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BEB470 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33nativeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • NtProtectVirtualMemory.NTDLL(000000FF,00000000,00000020,00000040,?,9870B143), ref: 00BEB4B1
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MemoryProtectVirtual
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2706961497-3916222277
                                                                                                                                                                • Opcode ID: ec96d8026560d792f2c7d6511b1a24b1e454705d4c9057a3873d1a3882eded8d
                                                                                                                                                                • Instruction ID: 25771b65fd2fceb7a8c226515687cfba38ad92651af6e3fa5dffd054fa492e8c
                                                                                                                                                                • Opcode Fuzzy Hash: ec96d8026560d792f2c7d6511b1a24b1e454705d4c9057a3873d1a3882eded8d
                                                                                                                                                                • Instruction Fuzzy Hash: F1F09070900208BBEB10CFE4CC88B9FB7BCEB04315F504294A524A72C1E7755B408B60
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE7E58 Relevance: 3.1, APIs: 2, Instructions: 73sleepnativeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00BE6844: RtlAllocateHeap.NTDLL(?,00000008,00000000,?,00BF7764,?,00000000,00000000), ref: 00BE6860
                                                                                                                                                                • NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 00BE7E7E
                                                                                                                                                                • Sleep.KERNELBASE(000007D0,?), ref: 00BE7F45
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AllocateHeapInformationQuerySleepSystem
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3184523392-0
                                                                                                                                                                • Opcode ID: 267880bc88c525ca4d815c82d5c501dfd8ef29d1c8708c369094215b32e22bb8
                                                                                                                                                                • Instruction ID: 99fe8dc1c2664a1b421b0017ade3978b523f4c23bb08e9ba36729fc4fb1b2d1f
                                                                                                                                                                • Opcode Fuzzy Hash: 267880bc88c525ca4d815c82d5c501dfd8ef29d1c8708c369094215b32e22bb8
                                                                                                                                                                • Instruction Fuzzy Hash: 52212771944248EFDF119FA2DC84BDEBBB8EF04305F2080D5E914AA161DB729A45DFA0
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE8F66 Relevance: 3.1, APIs: 2, Instructions: 70nativethreadCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RtlAdjustPrivilege.NTDLL(00000014,00000001,00000000,00000000), ref: 00BE8F8A
                                                                                                                                                                  • Part of subcall function 00BE97D8: NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 00BE9805
                                                                                                                                                                  • Part of subcall function 00BE9880: NtClose.NTDLL(00000000), ref: 00BE9971
                                                                                                                                                                • NtSetInformationThread.NTDLL(000000FE,00000005,00000000,00000004,00000000,00000002,00000002,D1F935A5), ref: 00BE8FC1
                                                                                                                                                                  • Part of subcall function 00BE8DA8: OpenSCManagerW.SECHOST(00000000,00000000,00000001,7DDDCD9C), ref: 00BE8DE6
                                                                                                                                                                  • Part of subcall function 00BE8DA8: CloseServiceHandle.SECHOST(00000000), ref: 00BE8EAD
                                                                                                                                                                  • Part of subcall function 00BE8DA8: CloseServiceHandle.ADVAPI32(00000000), ref: 00BE8EBC
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Close$HandleInformationService$AdjustManagerOpenPrivilegeQuerySystemThread
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 4089816224-0
                                                                                                                                                                • Opcode ID: 4e4483dfb43fc96e1482100762eb92636150aa29f07db041288ef6c2034d5ffe
                                                                                                                                                                • Instruction ID: cca77db2b8735150d48e8c02562e861b85e5eafa9e2cebe8912f11944436a7d7
                                                                                                                                                                • Opcode Fuzzy Hash: 4e4483dfb43fc96e1482100762eb92636150aa29f07db041288ef6c2034d5ffe
                                                                                                                                                                • Instruction Fuzzy Hash: 44214270900348BBEF20ABA6CC4EBDE7AF8EF04705F5045D4B515A71D6EB748A88DB61
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE8F68 Relevance: 3.1, APIs: 2, Instructions: 69nativethreadCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RtlAdjustPrivilege.NTDLL(00000014,00000001,00000000,00000000), ref: 00BE8F8A
                                                                                                                                                                  • Part of subcall function 00BE97D8: NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 00BE9805
                                                                                                                                                                  • Part of subcall function 00BE9880: NtClose.NTDLL(00000000), ref: 00BE9971
                                                                                                                                                                • NtSetInformationThread.NTDLL(000000FE,00000005,00000000,00000004,00000000,00000002,00000002,D1F935A5), ref: 00BE8FC1
                                                                                                                                                                  • Part of subcall function 00BE8DA8: OpenSCManagerW.SECHOST(00000000,00000000,00000001,7DDDCD9C), ref: 00BE8DE6
                                                                                                                                                                  • Part of subcall function 00BE8DA8: CloseServiceHandle.SECHOST(00000000), ref: 00BE8EAD
                                                                                                                                                                  • Part of subcall function 00BE8DA8: CloseServiceHandle.ADVAPI32(00000000), ref: 00BE8EBC
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Close$HandleInformationService$AdjustManagerOpenPrivilegeQuerySystemThread
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 4089816224-0
                                                                                                                                                                • Opcode ID: 469d8d19088ac7384fb9b122d28594899c96ec853784bb580a95661c341353d5
                                                                                                                                                                • Instruction ID: a83e3880a4adbb39ec5f49d83211e0f45c7758b04ebda94e3f5950efa50c4245
                                                                                                                                                                • Opcode Fuzzy Hash: 469d8d19088ac7384fb9b122d28594899c96ec853784bb580a95661c341353d5
                                                                                                                                                                • Instruction Fuzzy Hash: D5214270900348BBEF20ABA6CC4EBDE7AF8EF04705F5045D4B505A71D6E7748A88DB61
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE74BC Relevance: 3.1, APIs: 2, Instructions: 60fileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00BE7590: FindFirstFileExW.KERNELBASE(?,00000000,?,00000000,00000000,00000000), ref: 00BE75FF
                                                                                                                                                                • FindFirstFileExW.KERNELBASE(?,00000000,?,00000000,00000000,00000000), ref: 00BE751F
                                                                                                                                                                • FindNextFileW.KERNELBASE(000000FF,?), ref: 00BE7576
                                                                                                                                                                  • Part of subcall function 00BE766C: FindFirstFileExW.KERNELBASE(00000000,00000000,?,00000000,00000000,00000000), ref: 00BE76F3
                                                                                                                                                                  • Part of subcall function 00BE766C: GetFileAttributesW.KERNELBASE(00000000), ref: 00BE7786
                                                                                                                                                                  • Part of subcall function 00BE766C: FindNextFileW.KERNELBASE(000000FF,?), ref: 00BE77EF
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$Find$First$Next$Attributes
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 407996502-0
                                                                                                                                                                • Opcode ID: 8060e390438df1f8e70f6afbec3bd5d816cfb9188cb918815dea2a50f2337e75
                                                                                                                                                                • Instruction ID: 8d00b8b0ae95292048f1669f0bf63d34ab185db49e33910aa5b0160d714dc1ce
                                                                                                                                                                • Opcode Fuzzy Hash: 8060e390438df1f8e70f6afbec3bd5d816cfb9188cb918815dea2a50f2337e75
                                                                                                                                                                • Instruction Fuzzy Hash: 8E21EAB194020DABDB10EBA1DD4DFDEB7BCEB14301F4004E1AA09E6191EB759B54CF66
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE7EA3 Relevance: 3.1, APIs: 2, Instructions: 56sleepnativeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 00BE7E7E
                                                                                                                                                                • Sleep.KERNELBASE(000007D0,?), ref: 00BE7F45
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: InformationQuerySleepSystem
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3518162127-0
                                                                                                                                                                • Opcode ID: 4cf6d1ba83321acc5dea43c042a59e47cbd319ac2aa874d78fec09a0b49b0246
                                                                                                                                                                • Instruction ID: 84ec73db7a574420b69dd37f48e0dda140e2dba9ac0404ca214af7be742b70b5
                                                                                                                                                                • Opcode Fuzzy Hash: 4cf6d1ba83321acc5dea43c042a59e47cbd319ac2aa874d78fec09a0b49b0246
                                                                                                                                                                • Instruction Fuzzy Hash: C1210671944248EFDF11CF91C988BEEBBB8EF04305F2080D9E901AA161DB769A45DFA0
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE7E8A Relevance: 3.1, APIs: 2, Instructions: 56sleepnativeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 00BE7E7E
                                                                                                                                                                • Sleep.KERNELBASE(000007D0,?), ref: 00BE7F45
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: InformationQuerySleepSystem
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3518162127-0
                                                                                                                                                                • Opcode ID: 491a00fa957768370ead6ad0e1d6872cfc02256a77fdd7b163f376802d9f90e9
                                                                                                                                                                • Instruction ID: 84ec73db7a574420b69dd37f48e0dda140e2dba9ac0404ca214af7be742b70b5
                                                                                                                                                                • Opcode Fuzzy Hash: 491a00fa957768370ead6ad0e1d6872cfc02256a77fdd7b163f376802d9f90e9
                                                                                                                                                                • Instruction Fuzzy Hash: C1210671944248EFDF11CF91C988BEEBBB8EF04305F2080D9E901AA161DB769A45DFA0
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BEE1E8 Relevance: 3.0, APIs: 2, Instructions: 46nativethreadCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CreateThread.KERNELBASE(00000000,00000000,00BEDE78,00000000,00000000,00000000,?,00000000), ref: 00BEE239
                                                                                                                                                                  • Part of subcall function 00BEB444: NtSetInformationThread.NTDLL(00000000,?,00000000,00000000,?,00BE6541,00000000,00C0586C,00BE6390,00000000,00000000,00C05858,00BE6378,00000000,00000000,00C0584C), ref: 00BEB465
                                                                                                                                                                • NtClose.NTDLL(00000000,00000000,?,00000000), ref: 00BEE24C
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Thread$CloseCreateInformation
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3895992022-0
                                                                                                                                                                • Opcode ID: be2002d2207aa57fff370512629ef5810fabe4d880f9dc1ebdc1b2f8e0b4d1b7
                                                                                                                                                                • Instruction ID: fbf704c706954e9ed339e18c6e7d5217ea55e7bff54844f44aba0633c8df8195
                                                                                                                                                                • Opcode Fuzzy Hash: be2002d2207aa57fff370512629ef5810fabe4d880f9dc1ebdc1b2f8e0b4d1b7
                                                                                                                                                                • Instruction Fuzzy Hash: 2901AE70780B54EBE7106B955C8DB9F77E8EB14715F200350FE15A62E1EBB09D04C955
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BEB3C0 Relevance: 3.0, APIs: 2, Instructions: 43nativethreadCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • NtSetInformationThread.NTDLL(000000FE,00000005,00000008,00000004), ref: 00BEB424
                                                                                                                                                                • NtClose.NTDLL(00000008), ref: 00BEB432
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseInformationThread
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3167811113-0
                                                                                                                                                                • Opcode ID: 35240107cb8141401a9ec9b1563bdb8efff3b97c6076108627ec82a40fe7e7cd
                                                                                                                                                                • Instruction ID: 8a59b9d91f0dbf8e124e56ccdfb021eec4c85143f27fa7a5107552aa3a3f691e
                                                                                                                                                                • Opcode Fuzzy Hash: 35240107cb8141401a9ec9b1563bdb8efff3b97c6076108627ec82a40fe7e7cd
                                                                                                                                                                • Instruction Fuzzy Hash: 23012171500208AFE710CF51DC89FABBBB8FB00305F5581A5E9149B1A1D7B58A54DFA0
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BEA094 Relevance: 3.0, APIs: 2, Instructions: 27COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • FindFirstFileExW.KERNELBASE(?,00000000,?,00000000,00000000,00000000), ref: 00BEA0B6
                                                                                                                                                                • FindClose.KERNELBASE(000000FF), ref: 00BEA0DC
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Find$CloseFileFirst
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2295610775-0
                                                                                                                                                                • Opcode ID: 15472d5e8d740b1fe21165e84ae84858fd5a912d41edce4ee10424ce599e57a7
                                                                                                                                                                • Instruction ID: c55b8b345395ca4d15f4bdb7b1bb24c725fa0c321ca1aad62942bd370a09fad5
                                                                                                                                                                • Opcode Fuzzy Hash: 15472d5e8d740b1fe21165e84ae84858fd5a912d41edce4ee10424ce599e57a7
                                                                                                                                                                • Instruction Fuzzy Hash: 3DF03A74901208EFDB20DF94CC49B9DBBB4EB44310F208295A818AB2E0D7716F91DF44
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE9880 Relevance: 1.6, APIs: 1, Instructions: 68nativeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Close
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3535843008-0
                                                                                                                                                                • Opcode ID: 62fb50e1ffe7dc03a2e2ade38f05d94db537de3585bb9766e9abd01e6e4ef13f
                                                                                                                                                                • Instruction ID: 900de29dd4ae0baf0e67912897b8e853c6f4d5b629724644dafc93158d0404f5
                                                                                                                                                                • Opcode Fuzzy Hash: 62fb50e1ffe7dc03a2e2ade38f05d94db537de3585bb9766e9abd01e6e4ef13f
                                                                                                                                                                • Instruction Fuzzy Hash: 3F31BC7480020CEFEF00CF95D848BDEBBB8FB04309F508159E415BA291D77A9A49DF91
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE7590 Relevance: 1.6, APIs: 1, Instructions: 58COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • FindFirstFileExW.KERNELBASE(?,00000000,?,00000000,00000000,00000000), ref: 00BE75FF
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FileFindFirst
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1974802433-0
                                                                                                                                                                • Opcode ID: 8af9911b51bf2cb458b2534c01068ef4dbc6c4f641c85995b25fc20bd5e9a8a0
                                                                                                                                                                • Instruction ID: 71835eec9d2e3886f7eb28d49b84a4f461d901d3d74d3eb7793f96496ad1513e
                                                                                                                                                                • Opcode Fuzzy Hash: 8af9911b51bf2cb458b2534c01068ef4dbc6c4f641c85995b25fc20bd5e9a8a0
                                                                                                                                                                • Instruction Fuzzy Hash: 28214DB0840608EFDB10DF94DD0CBDDBBB9FF04309F1081A1E909AA1A1EB719A98DF55
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE97D8 Relevance: 1.6, APIs: 1, Instructions: 57nativeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00BE6844: RtlAllocateHeap.NTDLL(?,00000008,00000000,?,00BF7764,?,00000000,00000000), ref: 00BE6860
                                                                                                                                                                • NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 00BE9805
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AllocateHeapInformationQuerySystem
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3114120137-0
                                                                                                                                                                • Opcode ID: ceb0b205b3ef32972720b01684b85215d193e37600bdf9cf6b780008948fc7d3
                                                                                                                                                                • Instruction ID: ca7c0125300932b8d1e8ceeea3a64adb49505312bcaf1c4f12fae09e17f3d886
                                                                                                                                                                • Opcode Fuzzy Hash: ceb0b205b3ef32972720b01684b85215d193e37600bdf9cf6b780008948fc7d3
                                                                                                                                                                • Instruction Fuzzy Hash: 61113A71D00148FBCF11DF96D880ADDBBF9EF25390F2081E2EA10AA161D7325E54EB90
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE6C98 Relevance: 1.6, APIs: 1, Instructions: 56nativeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • NtQueryInformationToken.NTDLL(00000000,00000001,?,00000028,?,00000000), ref: 00BE6CDF
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: InformationQueryToken
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 4239771691-0
                                                                                                                                                                • Opcode ID: c8f6d8555794211179a926e5d9d025c9317f5927793009e5d8ba41a415f34079
                                                                                                                                                                • Instruction ID: 58f42a8c86f1cf2ce9d73607175e5c691374ba42c8011ce2d6613009204e57d7
                                                                                                                                                                • Opcode Fuzzy Hash: c8f6d8555794211179a926e5d9d025c9317f5927793009e5d8ba41a415f34079
                                                                                                                                                                • Instruction Fuzzy Hash: 5F114F70A0024DFBDF10DF91DC88BEEBBB8FF24345F6081A5E915A61A0D7718A58DB51
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE5A20 Relevance: 1.5, APIs: 1, Instructions: 40libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • LdrLoadDll.NTDLL(00000000,00000000,00000000,?), ref: 00BE5A71
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Load
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2234796835-0
                                                                                                                                                                • Opcode ID: 1f4f7a469baf97fd885f2a699f220b38648178abd63180c5df9108ab02f9fca3
                                                                                                                                                                • Instruction ID: 65ebd3c4a6d4c9eddd32516d3188783b7694a81fefbe05c3eb146742e5cccacf
                                                                                                                                                                • Opcode Fuzzy Hash: 1f4f7a469baf97fd885f2a699f220b38648178abd63180c5df9108ab02f9fca3
                                                                                                                                                                • Instruction Fuzzy Hash: 27F03C3690010DFECF20EE95D848FDEB7BCEB04318F4041A2A919A7040D330AB089BA0
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BEDC60 Relevance: 1.5, APIs: 1, Instructions: 34nativeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • NtTerminateProcess.NTDLL(00BE7DB8,00000000), ref: 00BEDCC3
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ProcessTerminate
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 560597551-0
                                                                                                                                                                • Opcode ID: 4c726947771ff8dfc26a81397d07669a92db696e2d8bdd005c8a53ec5587be0e
                                                                                                                                                                • Instruction ID: d33d0d5181925706969871cce46a534d87d0b740bee665f4df0ae78c3d858753
                                                                                                                                                                • Opcode Fuzzy Hash: 4c726947771ff8dfc26a81397d07669a92db696e2d8bdd005c8a53ec5587be0e
                                                                                                                                                                • Instruction Fuzzy Hash: 9F01A8B5900208EFDB00CF90D958BDEBFB8FB04319F648199E504AB291D7B79646DF91
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BEB674 Relevance: 1.5, APIs: 1, Instructions: 34nativeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • NtQueryInformationToken.NTDLL(?,00000001,?,0000002C,?), ref: 00BEB69E
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: InformationQueryToken
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 4239771691-0
                                                                                                                                                                • Opcode ID: 966bf79d4ef41ee252b432a0e50cad52a2c2a1026c1239412aa16096f6c277f2
                                                                                                                                                                • Instruction ID: 345ed6b541430fe7da8caf44d5d45a7713aebe841f5490c806492854c0c6832b
                                                                                                                                                                • Opcode Fuzzy Hash: 966bf79d4ef41ee252b432a0e50cad52a2c2a1026c1239412aa16096f6c277f2
                                                                                                                                                                • Instruction Fuzzy Hash: C0F01731601208AFEB10DBD5EC89FAEB7B9EB04315FA002A5F914E21A0E7619E548B50
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE982A Relevance: 1.5, APIs: 1, Instructions: 31nativeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 00BE9805
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: InformationQuerySystem
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3562636166-0
                                                                                                                                                                • Opcode ID: 5d1dbe18ff4074e456d2249ae37df75af1b03818bc652b28b773c712264f4708
                                                                                                                                                                • Instruction ID: ec06a796b1bbc9909e6b69007fff502083288eb392a8a57e85342a3b8c27562c
                                                                                                                                                                • Opcode Fuzzy Hash: 5d1dbe18ff4074e456d2249ae37df75af1b03818bc652b28b773c712264f4708
                                                                                                                                                                • Instruction Fuzzy Hash: DEF0B735904188EBDF11DF87D8C0BADB7F9EF25381F6040E2EA01AA161D3719A94EB51
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE9811 Relevance: 1.5, APIs: 1, Instructions: 31nativeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 00BE9805
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: InformationQuerySystem
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3562636166-0
                                                                                                                                                                • Opcode ID: 2b132861b0cedcaf5ca2fc04f64876e993ebceadf0766dfb91fa4b3c66c86ee5
                                                                                                                                                                • Instruction ID: ec06a796b1bbc9909e6b69007fff502083288eb392a8a57e85342a3b8c27562c
                                                                                                                                                                • Opcode Fuzzy Hash: 2b132861b0cedcaf5ca2fc04f64876e993ebceadf0766dfb91fa4b3c66c86ee5
                                                                                                                                                                • Instruction Fuzzy Hash: DEF0B735904188EBDF11DF87D8C0BADB7F9EF25381F6040E2EA01AA161D3719A94EB51
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BEB444 Relevance: 1.5, APIs: 1, Instructions: 18nativethreadCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • NtSetInformationThread.NTDLL(00000000,?,00000000,00000000,?,00BE6541,00000000,00C0586C,00BE6390,00000000,00000000,00C05858,00BE6378,00000000,00000000,00C0584C), ref: 00BEB465
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: InformationThread
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 4046476035-0
                                                                                                                                                                • Opcode ID: 84e4f573e47a3f1e36572efe641d857c0d4135f58bfc1fb9cec22c831872bec8
                                                                                                                                                                • Instruction ID: f7414acda6c6788aaab3093f6da5176faba77a9e87dfa197923506c3dbd61bf8
                                                                                                                                                                • Opcode Fuzzy Hash: 84e4f573e47a3f1e36572efe641d857c0d4135f58bfc1fb9cec22c831872bec8
                                                                                                                                                                • Instruction Fuzzy Hash: E1D0A7725A024CAFD7009F54DC45FF733ACD311302F104124B207C61D1D7B0A490C664
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BEA470 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetLogicalDriveStringsW.KERNELBASE(?,?), ref: 00BEA47B
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: DriveLogicalStrings
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2022863570-0
                                                                                                                                                                • Opcode ID: 0daa08d6aee22b47545f5a1c70de7e8696e039e2ec922960cf269d06af6add21
                                                                                                                                                                • Instruction ID: 56be3000cac843faaa0a7e25483a93a1149e17abbe933f467ef51c5f9d749d27
                                                                                                                                                                • Opcode Fuzzy Hash: 0daa08d6aee22b47545f5a1c70de7e8696e039e2ec922960cf269d06af6add21
                                                                                                                                                                • Instruction Fuzzy Hash: 88C09236000208EFCB019F88ED48D8ABFEEEB187007058061F6084B131CB32E820EF95
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BF946F Relevance: 47.5, APIs: 31, Instructions: 1045windowlibraryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: LibraryTextWindow$CreateDialogFreeLoad$BrushColorCommandErrorLastLineMenuPixelProc$ButtonCapsCheckedCountDeviceExitHeapImageItemMessageNamePaletteParamProcessSelectSolidTick
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2067994032-0
                                                                                                                                                                • Opcode ID: 8d793b9cbefdf62c2b55a3b1d06184de38321b7a9d8eea6d17220788660b9552
                                                                                                                                                                • Instruction ID: 2e272053792a31595f4617148c78caabb520e2decf3e41662d3f3e55f9ad6d94
                                                                                                                                                                • Opcode Fuzzy Hash: 8d793b9cbefdf62c2b55a3b1d06184de38321b7a9d8eea6d17220788660b9552
                                                                                                                                                                • Instruction Fuzzy Hash: B601171D4A955DAAC25137F8A807B7DAAE5AF32350F2994FCB308270E38FA0451CC577
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE8230 Relevance: 18.0, APIs: 8, Strings: 2, Instructions: 502COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 129 be8230-be8289 130 be828b 129->130 131 be8290-be829f 129->131 132 be88b9-be88bd 130->132 138 be82a6-be82b6 131->138 139 be82a1 131->139 134 be88bf 132->134 135 be88c8-be88cc 132->135 134->135 136 be88ce-be88d2 135->136 137 be88dd-be88e1 135->137 136->137 140 be88d4 136->140 141 be88ec-be88f0 137->141 142 be88e3 137->142 146 be82bd-be82cd 138->146 147 be82b8 138->147 139->132 140->137 144 be88fb-be88ff 141->144 145 be88f2 141->145 142->141 148 be8909-be890d 144->148 149 be8901-be8904 call be686c 144->149 145->144 159 be82cf 146->159 160 be82d4-be82ef call bf0e98 146->160 147->132 151 be890f-be8912 call be686c 148->151 152 be8917-be891b 148->152 149->148 151->152 154 be891d 152->154 155 be8926-be892a 152->155 154->155 157 be892c 155->157 158 be8935-be8939 155->158 157->158 161 be893b 158->161 162 be8944-be8948 158->162 159->132 167 be8319-be83a9 call be1240 160->167 168 be82f1-be8316 160->168 161->162 165 be894a-be894d 162->165 166 be8955-be895b 162->166 165->166 175 be83ab 167->175 176 be83b0-be83be 167->176 168->167 175->132 178 be83c5-be83d6 call be6844 176->178 179 be83c0 176->179 182 be83dd-be83e5 call be1564 178->182 183 be83d8 178->183 179->132 186 be83e7-be83f8 call be6de8 182->186 187 be8401-be8412 call be6de8 182->187 183->132 194 be83ff 186->194 195 be83fa 186->195 192 be8419-be8432 187->192 193 be8414 187->193 197 be8448-be845b 192->197 198 be8434-be8443 call be686c 192->198 193->132 194->192 195->132 202 be845d 197->202 203 be8462-be8478 197->203 198->132 202->132 205 be847f-be848d 203->205 206 be847a 203->206 208 be848f 205->208 209 be8494-be84e7 call be1564 205->209 206->132 208->132 215 be84f8 209->215 216 be84e9-be84f6 209->216 217 be84fb-be851c DrawTextW 215->217 216->217 218 be851e 217->218 219 be8523-be85cb 217->219 218->132 223 be85cd 219->223 224 be85d2-be85ff 219->224 223->132 227 be8606-be867f call be16c0 call be1240 CreateFileW 224->227 228 be8601 224->228 236 be8686-be86a0 WriteFile 227->236 237 be8681 227->237 228->132 238 be86a7-be86be WriteFile 236->238 239 be86a2 236->239 237->132 240 be86c5-be86dc WriteFile 238->240 241 be86c0 238->241 239->132 242 be86de 240->242 243 be86e3-be8707 call be6c98 240->243 241->132 242->132 247 be870e-be87b2 call be16c0 call be1240 RegCreateKeyExW 243->247 248 be8709 243->248 254 be87b9-be8818 call be1240 RegSetValueExW 247->254 255 be87b4 247->255 248->132 259 be881f-be88a0 call be1240 RegSetValueExW 254->259 260 be881a 254->260 255->132 264 be88a4-be88a8 259->264 265 be88a2 259->265 260->132 264->132 266 be88aa-be88b1 264->266 265->132 266->132
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID: ($BM
                                                                                                                                                                • API String ID: 0-2980357723
                                                                                                                                                                • Opcode ID: 8351c0836ff5d81f4272dcaacd0a63bd8bd7f67f4a305f4ff4c9ad2ce46ec92a
                                                                                                                                                                • Instruction ID: 3625627e2f1bf29139d2cfe233073ccb7462ef428e4eb14ce44f72f0facb5ae7
                                                                                                                                                                • Opcode Fuzzy Hash: 8351c0836ff5d81f4272dcaacd0a63bd8bd7f67f4a305f4ff4c9ad2ce46ec92a
                                                                                                                                                                • Instruction Fuzzy Hash: 27225874900609EFEF209FA1CC49BEEBBB4FF04301F5140A5E605BA2A1DB768A44DF65
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BEBC38 Relevance: 9.2, APIs: 6, Instructions: 190COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 469 bebc38-bebc62 471 bebc69-bebc80 469->471 472 bebc64 469->472 479 bebc87-bebc94 call be6844 471->479 480 bebc82 471->480 473 bebe8c-bebe90 472->473 474 bebe9b-bebe9f 473->474 475 bebe92 473->475 477 bebeaa-bebeae 474->477 478 bebea1-bebea4 DeleteDC 474->478 475->474 482 bebeb8-bebebc 477->482 483 bebeb0-bebeb3 call be686c 477->483 478->477 488 bebc9b-bebcf6 call be1240 CreateDCW 479->488 489 bebc96 479->489 480->473 486 bebebe 482->486 487 bebec7-bebecc 482->487 483->482 486->487 493 bebcfd-bebdc7 call be1240 StartDocW 488->493 494 bebcf8 488->494 489->473 505 bebdce-bebdd9 call be1720 493->505 506 bebdc9 493->506 494->473 509 bebdde-bebdea 505->509 506->473 511 bebdee-bebe66 DrawTextA EndPage 509->511 512 bebdec 509->512 511->509 513 bebe6c-bebe7b EndDoc call be1720 511->513 512->513 516 bebe80-bebe83 513->516 516->473
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Delete
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1035893169-0
                                                                                                                                                                • Opcode ID: c6f42915d927f3af88093566a3bfe283d58d4e4bdb1401e8c557a841dfd3509d
                                                                                                                                                                • Instruction ID: e6a308543d56008a464f09659cfe8ebaa9536598fc03c638d54eaec427271a08
                                                                                                                                                                • Opcode Fuzzy Hash: c6f42915d927f3af88093566a3bfe283d58d4e4bdb1401e8c557a841dfd3509d
                                                                                                                                                                • Instruction Fuzzy Hash: 18812570940609EFDF119FA0DC4ABEEBBB5FF04301F2044A8F605AA2A0C7764A50EF51
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BEE45C Relevance: 6.1, APIs: 4, Instructions: 61fileCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 837 bee45c-bee49a SetFileAttributesW CreateFileW 838 bee49c-bee4b9 SetFilePointerEx 837->838 839 bee511-bee518 837->839 840 bee4bb-bee4d8 ReadFile 838->840 841 bee508 838->841 840->841 842 bee4da-bee4ef call bee350 840->842 841->839 842->841 845 bee4f1-bee4f9 842->845 846 bee4fb 845->846 847 bee502-bee503 call be686c 845->847 846->847 847->841
                                                                                                                                                                APIs
                                                                                                                                                                • SetFileAttributesW.KERNELBASE(00000000,00000080,?), ref: 00BEE475
                                                                                                                                                                • CreateFileW.KERNELBASE(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00BEE48D
                                                                                                                                                                • SetFilePointerEx.KERNELBASE(000000FF,-00000084,00000000,00000000,00000002), ref: 00BEE4B1
                                                                                                                                                                • ReadFile.KERNELBASE(000000FF,?,00000084,?,00000000), ref: 00BEE4D0
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$AttributesCreatePointerRead
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 4170910816-0
                                                                                                                                                                • Opcode ID: 36087010bae04142c303414d986fba715b400400abe2e41c884b02c762a5420e
                                                                                                                                                                • Instruction ID: ebe382cfd0b5b9522d438f165b51422f80081113c82b1daf7beb2e889dba9e8d
                                                                                                                                                                • Opcode Fuzzy Hash: 36087010bae04142c303414d986fba715b400400abe2e41c884b02c762a5420e
                                                                                                                                                                • Instruction Fuzzy Hash: D3113A70A40208BBEB209FA1DC49F9E7BF9FB14700F5080A4B615A61E0EBB1AA54CB14
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BF0E98 Relevance: 4.7, APIs: 3, Instructions: 157registryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RegCreateKeyExW.KERNELBASE(80000002,?,00000000,00000000,00000000,00020119,00000000,?,00000000), ref: 00BF100D
                                                                                                                                                                • RegQueryValueExW.KERNELBASE(?,?,00000000,00000004,00000004,00000004), ref: 00BF1040
                                                                                                                                                                • RegDeleteKeyExW.KERNELBASE(80000002,?,00000100,00000000,000000FF,00000000), ref: 00BF10A9
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateDeleteQueryValue
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1796729037-0
                                                                                                                                                                • Opcode ID: bc3010c1d3fef094e90c3f93fff3f59cec108fb470e90da44bb251b89a61e799
                                                                                                                                                                • Instruction ID: 186a64fd6727193dff8ea3c493bafcd298cc094966b2a175b059a683ca60c04d
                                                                                                                                                                • Opcode Fuzzy Hash: bc3010c1d3fef094e90c3f93fff3f59cec108fb470e90da44bb251b89a61e799
                                                                                                                                                                • Instruction Fuzzy Hash: 6D5113B0950209AFEB20DF90CC49FFEBBBCFB04704F504095BA14AA1A1D7B59A58CF65
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BEEF6C Relevance: 4.6, APIs: 3, Instructions: 139fileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00BEE3AC: SetFileAttributesW.KERNELBASE(00000000,00000080,?,00000000,?,?,?), ref: 00BEE3CD
                                                                                                                                                                  • Part of subcall function 00BEE3AC: CreateFileW.KERNELBASE(00000000,40000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?,?,?), ref: 00BEE3E5
                                                                                                                                                                  • Part of subcall function 00BEE45C: SetFileAttributesW.KERNELBASE(00000000,00000080,?), ref: 00BEE475
                                                                                                                                                                  • Part of subcall function 00BEE45C: CreateFileW.KERNELBASE(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00BEE48D
                                                                                                                                                                  • Part of subcall function 00BEE45C: SetFilePointerEx.KERNELBASE(000000FF,-00000084,00000000,00000000,00000002), ref: 00BEE4B1
                                                                                                                                                                  • Part of subcall function 00BEE45C: ReadFile.KERNELBASE(000000FF,?,00000084,?,00000000), ref: 00BEE4D0
                                                                                                                                                                • MoveFileExW.KERNELBASE(00000000,00000000,00000008,00000000,00000000,00000000,00000000,?,00000000,?), ref: 00BEEFEF
                                                                                                                                                                • CreateIoCompletionPort.KERNELBASE(000000FF,00000000,00000000,00000000,00000000,?,?,00000000,?), ref: 00BEF0B0
                                                                                                                                                                • CreateFileW.KERNELBASE(00000000,C0000000,00000000,00000000,00000003,40000000,00000000,00000000,?,00000000,?), ref: 00BEF066
                                                                                                                                                                  • Part of subcall function 00BE686C: RtlFreeHeap.NTDLL(?,00000000,00000000,?,00BF77F4,00000000), ref: 00BE6888
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$Create$Attributes$CompletionFreeHeapMovePointerPortRead
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 97630321-0
                                                                                                                                                                • Opcode ID: 7f791affa0730002e235bea9b39a524965a344f25e8846ae82fcc9a01ab83b84
                                                                                                                                                                • Instruction ID: 4eceb9f34008d998b8198f5a13edf8a5668ba502efd36bb415be9bd963d9ff47
                                                                                                                                                                • Opcode Fuzzy Hash: 7f791affa0730002e235bea9b39a524965a344f25e8846ae82fcc9a01ab83b84
                                                                                                                                                                • Instruction Fuzzy Hash: 18513530900689FFEF116FA2DC49BAE7FB5FB10345F2180A5F515A50A2D7768A90EF41
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE8DA8 Relevance: 4.6, APIs: 3, Instructions: 78serviceCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00BE97D8: NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 00BE9805
                                                                                                                                                                • OpenSCManagerW.SECHOST(00000000,00000000,00000001,7DDDCD9C), ref: 00BE8DE6
                                                                                                                                                                • CloseServiceHandle.SECHOST(00000000), ref: 00BE8EAD
                                                                                                                                                                • CloseServiceHandle.ADVAPI32(00000000), ref: 00BE8EBC
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseHandleService$InformationManagerOpenQuerySystem
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1894214006-0
                                                                                                                                                                • Opcode ID: 797e491c7eb5d5da805a68e82b1c92e3366e1caa277cee5416debc41896f160c
                                                                                                                                                                • Instruction ID: 6bf733243a26dd4846e5c1e93e5e91cfa8c2dac936ee2f70f833a6f5368b5435
                                                                                                                                                                • Opcode Fuzzy Hash: 797e491c7eb5d5da805a68e82b1c92e3366e1caa277cee5416debc41896f160c
                                                                                                                                                                • Instruction Fuzzy Hash: 55310A70900A48EFDB10CF91CA49BAEBBB4EF04705F5580E5F506AB2A0DBB68E44DF51
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BEC19C Relevance: 4.6, APIs: 3, Instructions: 68COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: 6395fea53d448b4fca21d997c5a4f990370ae1c540ae90d61f7f1f99c7d18e65
                                                                                                                                                                • Instruction ID: 934bfaed1a5cad7a7f84d9b52f8a0f83e9555e824ffe341618a71aac65152510
                                                                                                                                                                • Opcode Fuzzy Hash: 6395fea53d448b4fca21d997c5a4f990370ae1c540ae90d61f7f1f99c7d18e65
                                                                                                                                                                • Instruction Fuzzy Hash: B121F030800188EFDF11ABA6DE4AB9D7FB2AF15315F2041E1E601691B2C7724E61FF46
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BEA488 Relevance: 4.6, APIs: 3, Instructions: 51threadCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CreateThread.KERNELBASE(00000000,00000000,00BEA470,?,00000004,00000000), ref: 00BEA4B9
                                                                                                                                                                • ResumeThread.KERNELBASE(00000000), ref: 00BEA4FD
                                                                                                                                                                • GetExitCodeThread.KERNELBASE(00000000,00000000), ref: 00BEA515
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Thread$CodeCreateExitResume
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 4070214711-0
                                                                                                                                                                • Opcode ID: 3943e2dd3e852ffce2fb05f735f601ecb9f0f05f5c0d9d07785e1ab997d97532
                                                                                                                                                                • Instruction ID: 2355f2bca6e5f2692507af0c9d87189d3b3974d9d6bcd3dfc7c3a8f4c16eb96f
                                                                                                                                                                • Opcode Fuzzy Hash: 3943e2dd3e852ffce2fb05f735f601ecb9f0f05f5c0d9d07785e1ab997d97532
                                                                                                                                                                • Instruction Fuzzy Hash: BF111030900208FFDF10DF94DD0AB9EBBB9FB08312F2081A5F915A22A0D7716A90EF50
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BEA1C0 Relevance: 4.5, APIs: 3, Instructions: 46threadCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CreateThread.KERNELBASE(00000000,00000000,00BEA1B0,?,00000004,00000000), ref: 00BEA1E4
                                                                                                                                                                • ResumeThread.KERNELBASE(00000000), ref: 00BEA228
                                                                                                                                                                • GetExitCodeThread.KERNELBASE(00000000,00000000), ref: 00BEA240
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Thread$CodeCreateExitResume
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 4070214711-0
                                                                                                                                                                • Opcode ID: 4585452597fae212c7b1ecc86c687baed0614a680ac06b099503bf4dc0c392e3
                                                                                                                                                                • Instruction ID: 4b29cd512f22a14d4cabbda70587481e00be03036d75d8f06eba4ff6e814d2b8
                                                                                                                                                                • Opcode Fuzzy Hash: 4585452597fae212c7b1ecc86c687baed0614a680ac06b099503bf4dc0c392e3
                                                                                                                                                                • Instruction Fuzzy Hash: 5D11E231940208FFDF119F90DD0AB9DBBB5EB04716F204194FA14A61A0E7726A60EF55
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE782C Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 295COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CoInitialize.OLE32(00000000), ref: 00BE7853
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Initialize
                                                                                                                                                                • String ID: @
                                                                                                                                                                • API String ID: 2538663250-2766056989
                                                                                                                                                                • Opcode ID: c46dcc0d0ccba67cac7883b7e0e5311627397c7ae540c5114eedbb13db6e8aee
                                                                                                                                                                • Instruction ID: fc07537fa9eb625bc8b129593e20dc073b48875454433d9a11eee2e56b3126ac
                                                                                                                                                                • Opcode Fuzzy Hash: c46dcc0d0ccba67cac7883b7e0e5311627397c7ae540c5114eedbb13db6e8aee
                                                                                                                                                                • Instruction Fuzzy Hash: 6ED1E5B494024AEFDB10CF91C888F9EBBB9FF04700F258195A514AF2A1D779DA84CF65
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BEE3AC Relevance: 3.1, APIs: 2, Instructions: 58fileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SetFileAttributesW.KERNELBASE(00000000,00000080,?,00000000,?,?,?), ref: 00BEE3CD
                                                                                                                                                                • CreateFileW.KERNELBASE(00000000,40000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?,?,?), ref: 00BEE3E5
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$AttributesCreate
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 415043291-0
                                                                                                                                                                • Opcode ID: 096804701e9c74f64297a212a6b4f23d6c7325fe06c20ee4462488a78fd2cbc7
                                                                                                                                                                • Instruction ID: 556841fd77781d54571cc4f774ad629e5718f53fd6d51fc6d44024425cbac6ec
                                                                                                                                                                • Opcode Fuzzy Hash: 096804701e9c74f64297a212a6b4f23d6c7325fe06c20ee4462488a78fd2cbc7
                                                                                                                                                                • Instruction Fuzzy Hash: 4511C630904248FBEF215B52EC49BAD7BF4EB04722F3082A6F531652E0D770AA41DE55
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BEF032 Relevance: 3.0, APIs: 2, Instructions: 36fileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • MoveFileExW.KERNELBASE(00000000,00000000,00000008,00000000,00000000,00000000,00000000,?,00000000,?), ref: 00BEEFEF
                                                                                                                                                                • CreateFileW.KERNELBASE(00000000,C0000000,00000000,00000000,00000003,40000000,00000000,00000000,?,00000000,?), ref: 00BEF066
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$CreateMove
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3198096935-0
                                                                                                                                                                • Opcode ID: 334c1dc9d95348fb61d882b9d023566ab0d96f03e3278f8745c5f3201dc1b205
                                                                                                                                                                • Instruction ID: d598ad481fed9484ee25a56649579045492e4c88186e3b300c36811227b906e6
                                                                                                                                                                • Opcode Fuzzy Hash: 334c1dc9d95348fb61d882b9d023566ab0d96f03e3278f8745c5f3201dc1b205
                                                                                                                                                                • Instruction Fuzzy Hash: BBF04930E00289FAEF216F96EC45BACBBB1EB10721F2081E2B611740E1C7715A50EA45
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE7468 Relevance: 3.0, APIs: 2, Instructions: 31COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetLogicalDriveStringsW.KERNELBASE(00000104,?), ref: 00BE747F
                                                                                                                                                                • GetDriveTypeW.KERNELBASE(?), ref: 00BE7495
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Drive$LogicalStringsType
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1630765265-0
                                                                                                                                                                • Opcode ID: de3d7c87ada18a285ab639335456080394f1fcc24ee32dd157c5e422bc323f81
                                                                                                                                                                • Instruction ID: 8af46ee4adf36b7a5becd6a44a13c29cb6106344cd254266ea53a18b0084406b
                                                                                                                                                                • Opcode Fuzzy Hash: de3d7c87ada18a285ab639335456080394f1fcc24ee32dd157c5e422bc323f81
                                                                                                                                                                • Instruction Fuzzy Hash: BEE02B3254479A5BDB20A6D79CC5AEB77FCCB01300F0001D0EE04D2281DF549D86CAE1
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE8EA2 Relevance: 3.0, APIs: 2, Instructions: 25serviceCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CloseServiceHandle.SECHOST(00000000), ref: 00BE8EAD
                                                                                                                                                                • CloseServiceHandle.ADVAPI32(00000000), ref: 00BE8EBC
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseHandleService
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1725840886-0
                                                                                                                                                                • Opcode ID: 52c527add6ce2fffc34bfcad87efa1b19a3a1d8e56ae07e6a5a40553aa2104a4
                                                                                                                                                                • Instruction ID: f76f04e7069452f0b1c6e01e5da1a6344210a84516f8679a5f29e0a9c5c38907
                                                                                                                                                                • Opcode Fuzzy Hash: 52c527add6ce2fffc34bfcad87efa1b19a3a1d8e56ae07e6a5a40553aa2104a4
                                                                                                                                                                • Instruction Fuzzy Hash: 1BF01530900648EFEB10CB81DE48BAEBBB8EF00305F5000D5B808A21A0CB720E84DE12
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BEE430 Relevance: 3.0, APIs: 2, Instructions: 23fileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SetFileAttributesW.KERNELBASE(00000000,00000080,?,00000000,?,?,?), ref: 00BEE3CD
                                                                                                                                                                • CreateFileW.KERNELBASE(00000000,40000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?,?,?), ref: 00BEE3E5
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$AttributesCreate
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 415043291-0
                                                                                                                                                                • Opcode ID: c40d1d0f905ba95d2c8f28733b4204d3db6e3666eca9ed1c311d2d73cb4cf1be
                                                                                                                                                                • Instruction ID: b0b0489096fdc99e79aa5fca2c2bb210fc744465e54d9e32e7328ea94ae8d5d8
                                                                                                                                                                • Opcode Fuzzy Hash: c40d1d0f905ba95d2c8f28733b4204d3db6e3666eca9ed1c311d2d73cb4cf1be
                                                                                                                                                                • Instruction Fuzzy Hash: 18E01230540684FAEB311B22DC49F5C3AB1AB04751F605261F632A81E0D7B4E641DA49
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BF0BE4 Relevance: 1.7, APIs: 1, Instructions: 184COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateThread
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2422867632-0
                                                                                                                                                                • Opcode ID: 8bb7b5c068ff659dc894fee340ac77fe88a52dc9596a5e5cb5b50ccb62d73b95
                                                                                                                                                                • Instruction ID: 1690e3861d32df709661b1cb313a2be34c78e6800d317634f5db3850845b0bda
                                                                                                                                                                • Opcode Fuzzy Hash: 8bb7b5c068ff659dc894fee340ac77fe88a52dc9596a5e5cb5b50ccb62d73b95
                                                                                                                                                                • Instruction Fuzzy Hash: E261647491020EEBDF10AFE1DC85BBEBBB5EB04305F2041A5EA01672B2D7756A48DF90
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE639C Relevance: 1.6, APIs: 1, Instructions: 134memoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RtlCreateHeap.NTDLL(00041002,00000000,00000000,00000000,00000000,00000000,E80C4717,?,?,00BF9487), ref: 00BE63C5
                                                                                                                                                                  • Part of subcall function 00BEB444: NtSetInformationThread.NTDLL(00000000,?,00000000,00000000,?,00BE6541,00000000,00C0586C,00BE6390,00000000,00000000,00C05858,00BE6378,00000000,00000000,00C0584C), ref: 00BEB465
                                                                                                                                                                  • Part of subcall function 00BEB470: NtProtectVirtualMemory.NTDLL(000000FF,00000000,00000020,00000040,?,9870B143), ref: 00BEB4B1
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateHeapInformationMemoryProtectThreadVirtual
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2986011945-0
                                                                                                                                                                • Opcode ID: 3dd68655f665e7bfe9ccdc8b1765c750a8d442793bb332138049d5960c0f1a5d
                                                                                                                                                                • Instruction ID: 7ae5f3a0f675ffa3322e7d471fbae87ac71db7e51aa057d9814bd7a134fb3dce
                                                                                                                                                                • Opcode Fuzzy Hash: 3dd68655f665e7bfe9ccdc8b1765c750a8d442793bb332138049d5960c0f1a5d
                                                                                                                                                                • Instruction Fuzzy Hash: D53166207D5BF87A8471326B4C0FE8F1EEC8DE2FA97C041E47508B51E78B916840C9BA
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE7CA4 Relevance: 1.6, APIs: 1, Instructions: 110COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • OpenSCManagerW.ADVAPI32(00000000,00000000,00000004), ref: 00BE7CBF
                                                                                                                                                                  • Part of subcall function 00BE6844: RtlAllocateHeap.NTDLL(?,00000008,00000000,?,00BF7764,?,00000000,00000000), ref: 00BE6860
                                                                                                                                                                  • Part of subcall function 00BEDC60: NtTerminateProcess.NTDLL(00BE7DB8,00000000), ref: 00BEDCC3
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AllocateHeapManagerOpenProcessTerminate
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3645570960-0
                                                                                                                                                                • Opcode ID: 0041283d8f37eda791b9faeb9d5d4c8b7d4e645898f392c6fe781f2339305cca
                                                                                                                                                                • Instruction ID: 23d1ac51b9285bf3da645a57bac92b81a4213dd42ec9f3367749d2a1077cbb38
                                                                                                                                                                • Opcode Fuzzy Hash: 0041283d8f37eda791b9faeb9d5d4c8b7d4e645898f392c6fe781f2339305cca
                                                                                                                                                                • Instruction Fuzzy Hash: 2941E571980208FBEF119B91DC0ABEEBBB9EF04705F5080A5B600B61E0DBB15A54DF54
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE5DA0 Relevance: 1.6, APIs: 1, Instructions: 106memoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00BE5C24: FindFirstFileW.KERNELBASE(?,?,?,00000004,?), ref: 00BE5CF7
                                                                                                                                                                  • Part of subcall function 00BE5C24: FindClose.KERNELBASE(000000FF,?,00000000), ref: 00BE5D1C
                                                                                                                                                                • RtlAllocateHeap.NTDLL(?,00000000,00000010,00000000,00000000,00000000,00000000,?,?,00BE6408,00C0540C,00BE5EE8,00000000,00000000,7E631824), ref: 00BE5DE4
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Find$AllocateCloseFileFirstHeap
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1673784098-0
                                                                                                                                                                • Opcode ID: 6aa6ab6f3a8d40e69fdb75059b62d8e3266041796467851bdc4e4ca92ca89f1e
                                                                                                                                                                • Instruction ID: 7b9d25f218e8d73adf1d782083e4f2c463a04025c56c85d346337389b97ca84d
                                                                                                                                                                • Opcode Fuzzy Hash: 6aa6ab6f3a8d40e69fdb75059b62d8e3266041796467851bdc4e4ca92ca89f1e
                                                                                                                                                                • Instruction Fuzzy Hash: 9A319F356047829ED720CF298881B55FAD5BF11315F58C7E9E5099F293EBB1C480CB9B
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE90BC Relevance: 1.6, APIs: 1, Instructions: 78serviceCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00BE903C: RtlAdjustPrivilege.NTDLL(00000014,00000001,00000000,00000000), ref: 00BE905E
                                                                                                                                                                • CloseServiceHandle.ADVAPI32(00000000), ref: 00BE91AF
                                                                                                                                                                  • Part of subcall function 00BEDC60: NtTerminateProcess.NTDLL(00BE7DB8,00000000), ref: 00BEDCC3
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AdjustCloseHandlePrivilegeProcessServiceTerminate
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3176663195-0
                                                                                                                                                                • Opcode ID: 645b0d69a7091477114d5315b9363c4043d6bd6f3ee8908c595ba0f41babcd35
                                                                                                                                                                • Instruction ID: 00dc90e6c33775ef149fcda46c4780f28ec24be0333a51e9e1edac521ad9a2a7
                                                                                                                                                                • Opcode Fuzzy Hash: 645b0d69a7091477114d5315b9363c4043d6bd6f3ee8908c595ba0f41babcd35
                                                                                                                                                                • Instruction Fuzzy Hash: 3231F170940209FFEB109FA1DC0DB9EBBB9EF04705F4140A4F604AA2A0D7B69A98CF11
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE6550 Relevance: 1.6, APIs: 1, Instructions: 66COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: d567ec5c46b6c9004d2164f794a62d5919071cce05633668c4ae81fe18c1f1a5
                                                                                                                                                                • Instruction ID: 85c99fdf2d5514b2181672a194ce86593a66c6538883eaf2d04d39f19c8e1bb0
                                                                                                                                                                • Opcode Fuzzy Hash: d567ec5c46b6c9004d2164f794a62d5919071cce05633668c4ae81fe18c1f1a5
                                                                                                                                                                • Instruction Fuzzy Hash: 4D214730951248EFDF209F95DC45BADBBF0FF25356F1140F5E805AA2A2E7714A90EB44
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BEF82C Relevance: 1.6, APIs: 1, Instructions: 302COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CoInitialize.OLE32(00000000,?,?,?,?,00000000), ref: 00BEF85B
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Initialize
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2538663250-0
                                                                                                                                                                • Opcode ID: 6b6eb1a2a53d2ca9b11f7b60fa5ce3f74ac22b13bca0bd125f032649eba1e5b0
                                                                                                                                                                • Instruction ID: 3504c617af85fa6b9f947f8b2c44307fd4586108077d8bf1db938c306381c0ae
                                                                                                                                                                • Opcode Fuzzy Hash: 6b6eb1a2a53d2ca9b11f7b60fa5ce3f74ac22b13bca0bd125f032649eba1e5b0
                                                                                                                                                                • Instruction Fuzzy Hash: E3C11A7490024AEFDB10DFA1D948BAEBBBCEF04700F2181A5E504AF262D779DA44DF65
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE9BB0 Relevance: 1.5, APIs: 1, Instructions: 46synchronizationCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CreateMutexW.KERNELBASE(0000000C,00000001,00000000), ref: 00BE9C4B
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateMutex
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1964310414-0
                                                                                                                                                                • Opcode ID: ea769f022ca6933cc02107b4bbf5fbefaabeb53262d3d484ae5f4c3e439a9d27
                                                                                                                                                                • Instruction ID: 8b2fcf89c67b84f070ea81f44348c2be5cda4f77741b82f318848579572038f3
                                                                                                                                                                • Opcode Fuzzy Hash: ea769f022ca6933cc02107b4bbf5fbefaabeb53262d3d484ae5f4c3e439a9d27
                                                                                                                                                                • Instruction Fuzzy Hash: B611C074804788EFEB11EBA1EC09BAE7BF5EB08301F200095F6049A2F1D7B11A48DF09
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE903C Relevance: 1.5, APIs: 1, Instructions: 42COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RtlAdjustPrivilege.NTDLL(00000014,00000001,00000000,00000000), ref: 00BE905E
                                                                                                                                                                  • Part of subcall function 00BE97D8: NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 00BE9805
                                                                                                                                                                  • Part of subcall function 00BE9880: NtClose.NTDLL(00000000), ref: 00BE9971
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AdjustCloseInformationPrivilegeQuerySystem
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 327775174-0
                                                                                                                                                                • Opcode ID: 3988613feb89f24d7d4879b2eea8303db2f59b94f92561c6e84308885e8e532d
                                                                                                                                                                • Instruction ID: 889e4cd90705fa421a425db291fc31f54e280c8dc42d24c7ea2c92c1f59d4fa4
                                                                                                                                                                • Opcode Fuzzy Hash: 3988613feb89f24d7d4879b2eea8303db2f59b94f92561c6e84308885e8e532d
                                                                                                                                                                • Instruction Fuzzy Hash: 9901F470950348BFEF209FA5CC4DFDE7AB8DB00715F504194B504A61D1E7B54A88CB91
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BEB708 Relevance: 1.5, APIs: 1, Instructions: 21COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RtlAdjustPrivilege.NTDLL(00000000,00000001,00000000,?), ref: 00BEB727
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AdjustPrivilege
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3260937286-0
                                                                                                                                                                • Opcode ID: eb0975b5dc2b51258ad9f0efbf0b331b3dc74924bfc91d48b63b235254434e9a
                                                                                                                                                                • Instruction ID: 36b8b06cb9409539409b1611eb35bd6f820847318a614e6f0731f058c3ecf7f8
                                                                                                                                                                • Opcode Fuzzy Hash: eb0975b5dc2b51258ad9f0efbf0b331b3dc74924bfc91d48b63b235254434e9a
                                                                                                                                                                • Instruction Fuzzy Hash: C4D02E722182196BCB301AA52C81FF733ECCB81321F100392AD02EB4D0FB62AE4486E1
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE6894 Relevance: 1.5, APIs: 1, Instructions: 14memoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RtlReAllocateHeap.NTDLL(?,00000008,?,00000400,?,00BE9825,?,00000400), ref: 00BE68B3
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AllocateHeap
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1279760036-0
                                                                                                                                                                • Opcode ID: ddf5f1d4a5cd8cc4cc895fc254f085f1da5b532b6f98c69147d02ad56819c1b9
                                                                                                                                                                • Instruction ID: ab3e05632c8b93eccade9dcea22aea235272c48d35643689ec14a4546ff135f8
                                                                                                                                                                • Opcode Fuzzy Hash: ddf5f1d4a5cd8cc4cc895fc254f085f1da5b532b6f98c69147d02ad56819c1b9
                                                                                                                                                                • Instruction Fuzzy Hash: 3FD0A731040604AFCB805F989C05FCA3768FB10700F418050FA448A062C731D850EB40
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE686C Relevance: 1.5, APIs: 1, Instructions: 13memoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RtlFreeHeap.NTDLL(?,00000000,00000000,?,00BF77F4,00000000), ref: 00BE6888
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FreeHeap
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3298025750-0
                                                                                                                                                                • Opcode ID: 815f681778b08a41e2cbf52917949cb49264bcf9d2d69dff5ca236a17c4df826
                                                                                                                                                                • Instruction ID: a7ce9e5926e8a7c1ade5435f10e999cd20e4a3b0ab3830de040d6c6c27f49781
                                                                                                                                                                • Opcode Fuzzy Hash: 815f681778b08a41e2cbf52917949cb49264bcf9d2d69dff5ca236a17c4df826
                                                                                                                                                                • Instruction Fuzzy Hash: DCD012311407449FC7549F99A809FDA37A8EB14704FC50451B7484B0A2C775D890DB94
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE6844 Relevance: 1.5, APIs: 1, Instructions: 13memoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RtlAllocateHeap.NTDLL(?,00000008,00000000,?,00BF7764,?,00000000,00000000), ref: 00BE6860
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AllocateHeap
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1279760036-0
                                                                                                                                                                • Opcode ID: 556af99999a3eb66571780dda622734b28acea53e5bb2f0eb087a78f60864adc
                                                                                                                                                                • Instruction ID: 3aaf5afcf0e4827ba1db1a63205ca0fc247526e8f1440c2cf0a12c69ac0ec33b
                                                                                                                                                                • Opcode Fuzzy Hash: 556af99999a3eb66571780dda622734b28acea53e5bb2f0eb087a78f60864adc
                                                                                                                                                                • Instruction Fuzzy Hash: A0D012311407449FC7509F9AA945FDA3768EB20702F854455B7484B062DB75D8D0EB94
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BEB4DC Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CheckTokenMembership.KERNELBASE(00000000,00BEB4CC,?), ref: 00BEB4ED
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CheckMembershipToken
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1351025785-0
                                                                                                                                                                • Opcode ID: 1744742a1908aba21efe97ffc6eb4eb68dc89e7f58e67a09b216d4b4f3d68a87
                                                                                                                                                                • Instruction ID: 38d8140e08a41ffd15c303970f9a01fa865b8db85d83be813064ea18e497ba6e
                                                                                                                                                                • Opcode Fuzzy Hash: 1744742a1908aba21efe97ffc6eb4eb68dc89e7f58e67a09b216d4b4f3d68a87
                                                                                                                                                                • Instruction Fuzzy Hash: 3CC0123454420CABD600D694AC46F5AB3AC9B04621F5003D0BD18923D1E7615F1089D1
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BEA1B0 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetDriveTypeW.KERNELBASE(?), ref: 00BEA1B6
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: DriveType
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 338552980-0
                                                                                                                                                                • Opcode ID: 3650ca826db894ebc92b3440148b84b61907f2d09b0e0b77a2c59485e28f538e
                                                                                                                                                                • Instruction ID: d7198cb635469b49268044ab4183a60c15b665c67cbe98614f4eebbfb28622a8
                                                                                                                                                                • Opcode Fuzzy Hash: 3650ca826db894ebc92b3440148b84b61907f2d09b0e0b77a2c59485e28f538e
                                                                                                                                                                • Instruction Fuzzy Hash: 39B0123100010CA7C6005B41EC0498A7F5DD7102617004021F5040102087325461D994
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE782A Relevance: 1.4, APIs: 1, Instructions: 159COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CoInitialize.OLE32(00000000), ref: 00BE7853
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Initialize
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2538663250-0
                                                                                                                                                                • Opcode ID: 8bd5ff7e31dbf46c0844a28dfc67fbb79434e461417be049078d8edf0bd89555
                                                                                                                                                                • Instruction ID: 34b6c99e3224448cedaf1db7baf1155a55771d95aa3dcd89e5d7cceb8580a1ba
                                                                                                                                                                • Opcode Fuzzy Hash: 8bd5ff7e31dbf46c0844a28dfc67fbb79434e461417be049078d8edf0bd89555
                                                                                                                                                                • Instruction Fuzzy Hash: 338102B8850346DFCB10DF51C988B89BBB8FF05344F16858895186F262C77ADA84CFA6
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BEDE48 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • Sleep.KERNELBASE(000000C8,?,?,00BEE405,00000000,?,00000000,?,?,?), ref: 00BEDE6B
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Sleep
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3472027048-0
                                                                                                                                                                • Opcode ID: 2feff4bcba2c848c36283d2c976a689bc5c6d0a2723c3239e69356772a1b6dcc
                                                                                                                                                                • Instruction ID: c7fb66f32dfe94e7adfabc9b31387e3dc2b23a350e5af0e213b5259f2f8eb118
                                                                                                                                                                • Opcode Fuzzy Hash: 2feff4bcba2c848c36283d2c976a689bc5c6d0a2723c3239e69356772a1b6dcc
                                                                                                                                                                • Instruction Fuzzy Hash: 69D0A7712093841BDF107AEA9CC591FF6C9EB20340B108177FA0045101CBF1CC148550
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Non-executed Functions

                                                                                                                                                                Function 00BE4D08 Relevance: .3, Instructions: 328COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: ff2345c773ddd4d997ef11b520458068fb3f451e803c00051301ae8fd474074d
                                                                                                                                                                • Instruction ID: 7178d561d101698c6ac7cc1b2f538b15fcb8ac8ebe0e3994d83717d5546a3008
                                                                                                                                                                • Opcode Fuzzy Hash: ff2345c773ddd4d997ef11b520458068fb3f451e803c00051301ae8fd474074d
                                                                                                                                                                • Instruction Fuzzy Hash: 56E1237AA20D428BD725CF1AECC4725B3E2FB89740F198578C6158BB55C735FA60DB80
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE20AC Relevance: .3, Instructions: 307COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: 5ae1b344ce7eabeca7d5a0e2004a9b7e15b356c338447e056007cc76e97bc746
                                                                                                                                                                • Instruction ID: 7b3ae59735443b6f328559ab9e21e595de7fdfd742b1eb10b27f64ecc91f38d6
                                                                                                                                                                • Opcode Fuzzy Hash: 5ae1b344ce7eabeca7d5a0e2004a9b7e15b356c338447e056007cc76e97bc746
                                                                                                                                                                • Instruction Fuzzy Hash: FDD1E3719083858FC790CF29C58065AF7E4FFD8348F149A1EE9D9D3211E770EA998B82
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE5218 Relevance: .3, Instructions: 287COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: a0e26850d5a9846b9c53206ee3a9df6c291159461086189c2705a4c48485e790
                                                                                                                                                                • Instruction ID: 4281dd0eaf310da642ea90743ac0ca79f41b1510161f1d8c727bcd7ad583d6cc
                                                                                                                                                                • Opcode Fuzzy Hash: a0e26850d5a9846b9c53206ee3a9df6c291159461086189c2705a4c48485e790
                                                                                                                                                                • Instruction Fuzzy Hash: 24D1327AE2058A8BDB14CF59ECD0B7AB3B2FB88740F158578C7119B756CA74EA10CB50
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE80B8 Relevance: .1, Instructions: 136COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: d63ae267ec830b17d43e45e433e07d8fa567569e3c64c5d921b185b94dce4ef3
                                                                                                                                                                • Instruction ID: 6cd5742380cd777c857c854aadf26f52241294d7dedf0ed5c56aac8c4a2b9ad1
                                                                                                                                                                • Opcode Fuzzy Hash: d63ae267ec830b17d43e45e433e07d8fa567569e3c64c5d921b185b94dce4ef3
                                                                                                                                                                • Instruction Fuzzy Hash: EC310522BCAD864AFF76E0A396817F7A3D4EB187A0DED01D3C64E235424F190C829653
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE4D03 Relevance: .1, Instructions: 77COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: 1a227a4e754ebede5e1eb3f591c7213b08b8e941d7746252def8c0ef60e55171
                                                                                                                                                                • Instruction ID: 7a8a80bf738e6e8bd48726b090c3169f196cf82ad1382168dcabf98f9f75fd7a
                                                                                                                                                                • Opcode Fuzzy Hash: 1a227a4e754ebede5e1eb3f591c7213b08b8e941d7746252def8c0ef60e55171
                                                                                                                                                                • Instruction Fuzzy Hash: 62313A76A11A469BC329CF1AD8C4925F7F1FF9D710B15CA29C95987B91C730F950CB80
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BE10BC Relevance: .0, Instructions: 37COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000000.00000002.2100861125.0000000000BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                                                                • Associated: 00000000.00000002.2100804863.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100929192.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2100990746.0000000000BFB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101059591.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101125900.0000000000C06000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                • Associated: 00000000.00000002.2101188333.0000000000C07000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_0_2_be0000_Document.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: 6e9e9d037a559c25274071be2e09c2d3cf2f15b9f66fb5d997d9d64617e40bf4
                                                                                                                                                                • Instruction ID: 5cc28dafef813a69904917c1950f68b5a0b98b443a4fa17f3f187cf8a49173b8
                                                                                                                                                                • Opcode Fuzzy Hash: 6e9e9d037a559c25274071be2e09c2d3cf2f15b9f66fb5d997d9d64617e40bf4
                                                                                                                                                                • Instruction Fuzzy Hash: 2EE04FBB20D3425FF928951674537A78387C380675E2588DEE416DF1C0EF1BE8A52045
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Execution Graph

                                                                                                                                                                Execution Coverage:32.4%
                                                                                                                                                                Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                Signature Coverage:1.3%
                                                                                                                                                                Total number of Nodes:160
                                                                                                                                                                Total number of Limit Nodes:1
                                                                                                                                                                execution_graph 890 403983 893 40389c 890->893 902 402a78 893->902 897 403903 932 4022dc 897->932 938 4028ba 902->938 904 402a9e 904->897 907 4026c0 904->907 905 402af0 CreateMutexW 905->904 952 4024f8 907->952 909 402729 909->897 913 402f18 909->913 910 4026e7 CreateFileW 910->909 911 40270b ReadFile 910->911 911->909 914 402f2e 913->914 914->914 956 40227c FindFirstFileExW 914->956 915 402f67 CreateFileW 917 402f57 915->917 920 402faf 915->920 916 402faa 919 4030c5 NtFreeVirtualMemory 916->919 921 4030ed 916->921 917->915 917->916 918 402fb4 NtAllocateVirtualMemory 918->920 927 402fe8 918->927 919->916 920->918 920->927 922 4030f3 NtClose 921->922 923 4030ff 921->923 922->923 958 402e10 923->958 925 40311f 925->897 926 40304b WriteFile 926->927 928 403068 SetFilePointerEx 926->928 927->916 927->926 929 403095 SetFilePointerEx 927->929 928->926 928->927 929->927 933 402303 932->933 934 402335 GetShortPathNameW 933->934 935 402330 27 API calls 933->935 934->935 936 40235e 934->936 936->935 937 40246d ShellExecuteW 936->937 937->935 939 4028dd 938->939 942 402760 CreateFileW 939->942 943 4027da 942->943 944 402797 942->944 945 402802 943->945 946 4027f6 NtClose 943->946 944->943 950 4020bc 944->950 945->904 945->905 946->945 947 4027b7 947->943 948 4027c0 ReadFile 947->948 948->943 951 4020c8 RtlAllocateHeap 950->951 951->947 953 402512 952->953 955 402760 4 API calls 953->955 954 402522 954->909 954->910 955->954 957 4022af 956->957 957->917 960 402e2e 958->960 959 402e37 DeleteFileW 959->925 960->959 960->960 961 402e7c MoveFileExW 960->961 961->959 961->960 962 403956 963 403963 962->963 964 403976 962->964 971 4019d4 963->971 1009 4016b4 971->1009 974 4016b4 9 API calls 975 4019f4 974->975 976 4016b4 9 API calls 975->976 977 401a05 976->977 978 4016b4 9 API calls 977->978 979 401a16 978->979 980 4016b4 9 API calls 979->980 981 401a27 980->981 982 4016b4 9 API calls 981->982 983 401a38 982->983 984 401b70 RtlCreateHeap 983->984 985 401ba6 RtlCreateHeap 984->985 995 401ba1 984->995 986 401bcb 985->986 985->995 986->995 1057 401a40 986->1057 988 401c03 989 401a40 RtlAllocateHeap 988->989 988->995 990 401c59 989->990 991 401a40 RtlAllocateHeap 990->991 990->995 992 401caf 991->992 993 401a40 RtlAllocateHeap 992->993 992->995 994 401d05 993->994 994->995 996 401a40 RtlAllocateHeap 994->996 1001 402812 995->1001 1005 402836 995->1005 997 401d55 996->997 997->995 1062 401d94 997->1062 998 401d7a 1065 401dc2 998->1065 1002 402836 1001->1002 1003 402850 RtlAdjustPrivilege 1002->1003 1004 40284e 1002->1004 1003->1002 1003->1004 1004->964 1006 402849 1005->1006 1007 402850 RtlAdjustPrivilege 1006->1007 1008 40284e 1006->1008 1007->1006 1007->1008 1008->964 1010 40176f 1009->1010 1011 4016cf 1009->1011 1010->974 1012 4016f5 NtAllocateVirtualMemory 1011->1012 1035 401000 1011->1035 1012->1010 1014 40172f NtAllocateVirtualMemory 1012->1014 1014->1010 1016 401752 1014->1016 1020 40152c 1016->1020 1018 40175f 1018->1010 1019 401000 3 API calls 1018->1019 1019->1018 1021 401540 1020->1021 1022 401558 1020->1022 1023 401000 3 API calls 1021->1023 1024 401000 3 API calls 1022->1024 1025 40157e 1022->1025 1023->1022 1024->1025 1026 401000 3 API calls 1025->1026 1029 4015a4 1025->1029 1026->1029 1027 4015ed FindFirstFileExW 1027->1029 1028 40166c 1028->1018 1029->1027 1029->1028 1030 401649 FindNextFileW 1029->1030 1031 40162a FindClose 1029->1031 1030->1029 1033 40165d FindClose 1030->1033 1043 401474 1031->1043 1033->1029 1034 401641 1034->1018 1036 401012 1035->1036 1037 40102a 1035->1037 1038 401000 3 API calls 1036->1038 1039 401000 3 API calls 1037->1039 1040 401050 1037->1040 1038->1037 1039->1040 1041 4010fb 1040->1041 1046 401394 1040->1046 1041->1012 1044 40148a 1043->1044 1045 4014b8 LdrLoadDll 1044->1045 1045->1034 1047 4013ee 1046->1047 1048 4013be 1046->1048 1047->1041 1048->1047 1049 401474 LdrLoadDll 1048->1049 1050 4013d2 1049->1050 1050->1047 1050->1050 1052 4014d8 1050->1052 1053 4014ee 1052->1053 1054 40150f LdrGetProcedureAddress 1052->1054 1056 4014fa LdrGetProcedureAddress 1053->1056 1055 401521 1054->1055 1055->1047 1056->1055 1058 401a5d RtlAllocateHeap 1057->1058 1059 401a79 1058->1059 1060 401a85 1058->1060 1059->988 1060->1058 1061 401b5b 1060->1061 1061->988 1063 401da8 NtSetInformationThread 1062->1063 1063->998 1066 401de9 1065->1066 1067 401e12 1066->1067 1068 401df2 NtProtectVirtualMemory 1066->1068 1067->995 1068->1067 1083 402126 1084 402141 1083->1084 1085 4020bc RtlAllocateHeap 1084->1085 1086 402158 1084->1086 1085->1086 1069 4019b7 1070 4019e0 1069->1070 1071 4016b4 9 API calls 1069->1071 1072 4016b4 9 API calls 1070->1072 1071->1070 1073 4019f4 1072->1073 1074 4016b4 9 API calls 1073->1074 1075 401a05 1074->1075 1076 4016b4 9 API calls 1075->1076 1077 401a16 1076->1077 1078 4016b4 9 API calls 1077->1078 1079 401a27 1078->1079 1080 4016b4 9 API calls 1079->1080 1081 401a38 1080->1081 1082 40286c NtSetInformationProcess NtSetInformationProcess NtSetInformationProcess

                                                                                                                                                                Callgraph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                • Opacity -> Relevance
                                                                                                                                                                • Disassembly available
                                                                                                                                                                callgraph 0 Function_004026C0 38 Function_004024F8 0->38 1 Function_00401A40 39 Function_00401E78 1->39 2 Function_00401DC2 3 Function_004024C2 4 Function_00402B44 5 Function_00403144 6 Function_00401FC8 7 Function_00401F4C 8 Function_0040204C 9 Function_00402B50 10 Function_00401350 71 Function_00401130 10->71 11 Function_00402ED0 12 Function_004024D4 13 Function_004019D4 76 Function_004016B4 13->76 14 Function_00403956 14->13 33 Function_00401B70 14->33 54 Function_00402812 14->54 78 Function_00402836 14->78 15 Function_00403258 16 Function_004014D8 81 Function_00401438 16->81 17 Function_00401FDB 18 Function_004022DC 19 Function_0040205C 20 Function_00401F5C 21 Function_004020DE 22 Function_00402760 83 Function_004020BC 22->83 23 Function_004031E0 24 Function_00402264 25 Function_00401EE4 26 Function_004032E4 27 Function_004032E8 28 Function_00401868 29 Function_0040286C 30 Function_00401F6C 31 Function_00401B6E 32 Function_00401FEF 33->1 33->2 55 Function_00401D94 33->55 34 Function_00401472 35 Function_00401474 41 Function_004013F8 35->41 36 Function_004013F6 37 Function_00402A78 82 Function_004028BA 37->82 38->22 62 Function_00401E28 39->62 40 Function_00403478 42 Function_0040227C 43 Function_0040217C 44 Function_00402BFC 45 Function_00401000 45->7 45->10 45->25 45->45 56 Function_00401394 45->56 73 Function_00401EB0 45->73 46 Function_00402D80 47 Function_00403983 60 Function_0040389C 47->60 48 Function_00402003 49 Function_00402104 50 Function_00402C88 51 Function_00402E10 52 Function_00401190 52->71 53 Function_00401911 56->16 56->35 57 Function_00402017 58 Function_00402F18 58->42 58->51 59 Function_00401F9A 60->0 60->18 60->37 60->58 61 Function_00402126 61->83 63 Function_00402DA8 64 Function_0040152A 65 Function_0040202A 66 Function_0040152C 66->19 66->25 66->35 66->45 67 Function_00401F2C 66->67 68 Function_004018AD 69 Function_0040362E 70 Function_00401EAE 72 Function_00403230 74 Function_00401FB1 75 Function_004016B2 76->39 76->45 76->66 77 Function_00402234 79 Function_00401436 80 Function_004019B7 80->76 82->22 84 Function_00401A3E

                                                                                                                                                                Executed Functions

                                                                                                                                                                Function 00403983 Relevance: 40.5, APIs: 27, Instructions: 32windowlibraryloaderCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2106664993.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2106606419.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2106992208.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2107146940.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2107215824.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_400000_D448.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Text$Color$CreateWindow$Proc$CommandFontFreeHandleLibraryLineLoadMenuModule$AddressBitmapCharsetErrorExitInfoLastLocaleObjectProcessSelect
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3548022523-0
                                                                                                                                                                • Opcode ID: 75a7f395dfd15dd6a7f12e7587c497a330da91454d241e242464d6c2316bf13f
                                                                                                                                                                • Instruction ID: 44f13d8dc4ada08d969f55db554330e9d88bd117b0c18836a0928b418f5903af
                                                                                                                                                                • Opcode Fuzzy Hash: 75a7f395dfd15dd6a7f12e7587c497a330da91454d241e242464d6c2316bf13f
                                                                                                                                                                • Instruction Fuzzy Hash: 89F0B724B651416AC500BFFB9947A0D6E2C6E8472BB50657EB0C1344E74D3C87009EAF
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00402F18 Relevance: 12.2, APIs: 8, Instructions: 184filenativememoryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 3 402f18-402f2b 4 402f2e-402f33 3->4 4->4 5 402f35-402f5b call 40227c 4->5 7 402f67-402f8c CreateFileW 5->7 8 402f5d-402f61 5->8 9 402f8e-402f96 7->9 10 402faf-402fb1 7->10 8->7 11 4030bb-4030bd 8->11 12 402f98-402fa6 9->12 13 402faa 9->13 14 402fb4-402fe0 NtAllocateVirtualMemory 10->14 15 4030c0-4030c3 11->15 12->13 27 402fa8 12->27 13->11 16 402fe2-402fed 14->16 17 402fe8 14->17 18 4030c5-4030e4 NtFreeVirtualMemory 15->18 19 4030e7-4030eb 15->19 28 403000-403003 16->28 29 402fef-402ffe 16->29 22 40301b-403020 17->22 18->19 19->15 23 4030ed-4030f1 19->23 26 403023-40302e 22->26 24 4030f3-4030fc NtClose 23->24 25 4030ff-40311d call 402e10 DeleteFileW 23->25 24->25 36 403126-40312a 25->36 37 40311f 25->37 30 403030-40303a 26->30 31 40303c 26->31 27->7 32 403015-403019 28->32 33 403005-403010 28->33 29->32 35 403041-403048 30->35 31->35 32->14 32->22 33->32 38 40304b-403064 WriteFile 35->38 39 403138-403141 36->39 40 40312c-403132 36->40 37->36 41 403066 38->41 42 403068-403088 SetFilePointerEx 38->42 40->39 43 40308a-403091 41->43 42->38 42->43 44 403093 43->44 45 403095-4030b6 SetFilePointerEx 43->45 44->11 45->26
                                                                                                                                                                APIs
                                                                                                                                                                • CreateFileW.KERNELBASE(?,40000000,00000003,00000000,00000003,80000000,00000000), ref: 00402F82
                                                                                                                                                                • NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00010000,00001000,00000004), ref: 00402FDB
                                                                                                                                                                • WriteFile.KERNELBASE(000000FF,00000000,00010000,00010000,00000000), ref: 0040305F
                                                                                                                                                                • SetFilePointerEx.KERNELBASE(000000FF,00010000,?,00000000,00000001), ref: 0040307E
                                                                                                                                                                • SetFilePointerEx.KERNELBASE(000000FF,00010000,00000000,00000000,00000000,?,00000000,00000001), ref: 004030B3
                                                                                                                                                                • NtFreeVirtualMemory.NTDLL(000000FF,00000000,00010000,00008000,?,00000000,00000001), ref: 004030E4
                                                                                                                                                                • NtClose.NTDLL(000000FF,?,00000000,00000001), ref: 004030FC
                                                                                                                                                                • DeleteFileW.KERNELBASE(?,?,00000000,00000001), ref: 00403118
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2106664993.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2106606419.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2106992208.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2107146940.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2107215824.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_400000_D448.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$MemoryPointerVirtual$AllocateCloseCreateDeleteFreeWrite
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 590822095-0
                                                                                                                                                                • Opcode ID: 52122dafd602033dbf0aaa267e6343e8fb4df09450a7f36494692c9b8865e816
                                                                                                                                                                • Instruction ID: 1b8bdb635f3090c090aca30f1047892238d11e79f8ef36d2dcee79009cce4089
                                                                                                                                                                • Opcode Fuzzy Hash: 52122dafd602033dbf0aaa267e6343e8fb4df09450a7f36494692c9b8865e816
                                                                                                                                                                • Instruction Fuzzy Hash: ED714871901209AFDB11CF90DD48BEEBB79FB08311F204266E511B62D4D3759E85CF99
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 0040152C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 104fileCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                • FindFirstFileExW.KERNELBASE(C:\Windows\System32\*.dll,00000000,?,00000000,00000000,00000000), ref: 00401601
                                                                                                                                                                • FindClose.KERNELBASE(000000FF,?,00000000), ref: 0040162D
                                                                                                                                                                • FindNextFileW.KERNELBASE(000000FF,?,?,00000000), ref: 00401653
                                                                                                                                                                • FindClose.KERNEL32(000000FF), ref: 00401660
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2106664993.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2106606419.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2106992208.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2107146940.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2107215824.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_400000_D448.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Find$CloseFile$FirstNext
                                                                                                                                                                • String ID: C:\Windows\System32\*.dll
                                                                                                                                                                • API String ID: 1164774033-1305136377
                                                                                                                                                                • Opcode ID: bdb8730289e2ca857be386bc3c3ab385330ed8d95a663a52d2d02b9110bb0279
                                                                                                                                                                • Instruction ID: b8f602421e8d3e3309feb9384621a56ef9d54da146c7d7394d3b11ea37959a12
                                                                                                                                                                • Opcode Fuzzy Hash: bdb8730289e2ca857be386bc3c3ab385330ed8d95a663a52d2d02b9110bb0279
                                                                                                                                                                • Instruction Fuzzy Hash: 30418C71900608EFDB20AFA4DD48BAA77B4FB44325F608276E521BE1F0D7794A85DF48
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00402760 Relevance: 4.6, APIs: 3, Instructions: 62filenativeCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 82 402760-402795 CreateFileW 83 4027f0-4027f4 82->83 84 402797-4027a9 82->84 85 402802-40280b 83->85 86 4027f6-4027ff NtClose 83->86 84->83 88 4027ab-4027be call 4020bc 84->88 86->85 88->83 90 4027c0-4027d8 ReadFile 88->90 91 4027e4-4027ea 90->91 92 4027da-4027e2 90->92 91->83 92->83
                                                                                                                                                                APIs
                                                                                                                                                                • CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0040278B
                                                                                                                                                                • ReadFile.KERNELBASE(000000FF,00000000,00000000,00000000,00000000), ref: 004027D3
                                                                                                                                                                • NtClose.NTDLL(000000FF), ref: 004027FF
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2106664993.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2106606419.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2106992208.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2107146940.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2107215824.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_400000_D448.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$CloseCreateRead
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1419693385-0
                                                                                                                                                                • Opcode ID: da89fd3cbdd23a7ddbe5d8b9f381f279ea58f3e72d3b71a90626c9ff8252170d
                                                                                                                                                                • Instruction ID: da411bd40fb0d6d878d2d447c4e829303a7e8bd202b0d35ae7576ead56d2946b
                                                                                                                                                                • Opcode Fuzzy Hash: da89fd3cbdd23a7ddbe5d8b9f381f279ea58f3e72d3b71a90626c9ff8252170d
                                                                                                                                                                • Instruction Fuzzy Hash: CA211A35601209EBDB10CF94DD89B9EBB75FF08310F2082A5A510AB2E1D7719E51DF94
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 0040286C Relevance: 4.5, APIs: 3, Instructions: 28nativeCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 94 40286c-4028b9 NtSetInformationProcess * 3
                                                                                                                                                                APIs
                                                                                                                                                                • NtSetInformationProcess.NTDLL(000000FF,00000021,?,00000004), ref: 00402888
                                                                                                                                                                • NtSetInformationProcess.NTDLL(000000FF,00000012,00000000,00000002,?,00000004), ref: 0040289D
                                                                                                                                                                • NtSetInformationProcess.NTDLL(000000FF,0000000C,00000000,00000004,?,00000004), ref: 004028B5
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2106664993.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2106606419.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2106992208.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2107146940.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2107215824.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_400000_D448.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: InformationProcess
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1801817001-0
                                                                                                                                                                • Opcode ID: b71ac733508e6e437ba76d930e61bde730921b23b00966883a2217b3d9eaec84
                                                                                                                                                                • Instruction ID: 48adbd17ca007e7691ff2066b81a5959555298f4bd9a539b6f325b5cfe831ef7
                                                                                                                                                                • Opcode Fuzzy Hash: b71ac733508e6e437ba76d930e61bde730921b23b00966883a2217b3d9eaec84
                                                                                                                                                                • Instruction Fuzzy Hash: 2BF0F871141610EBEB15DB84DDC9F9637A8FB09720F2403A1F2319E1E6D3B0A484CF96
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00401DC2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 38nativeCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 95 401dc2-401df0 97 401e21-401e27 95->97 98 401df2-401e10 NtProtectVirtualMemory 95->98 98->97 99 401e12-401e1f 98->99 99->97
                                                                                                                                                                APIs
                                                                                                                                                                • NtProtectVirtualMemory.NTDLL(000000FF,00000000,00000020,00000040,?), ref: 00401E0B
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2106664993.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2106606419.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2106992208.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2107146940.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2107215824.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_400000_D448.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MemoryProtectVirtual
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2706961497-3916222277
                                                                                                                                                                • Opcode ID: 743ccc95185ac25335bad8a24ea2ffb6d91b2a6f6c30658889cc31c7cdbad58c
                                                                                                                                                                • Instruction ID: 836d3446d31acb3b31e0b6cd8f4ee088cd02c28435d2c0c4ff934eaabbb3754d
                                                                                                                                                                • Opcode Fuzzy Hash: 743ccc95185ac25335bad8a24ea2ffb6d91b2a6f6c30658889cc31c7cdbad58c
                                                                                                                                                                • Instruction Fuzzy Hash: 72F03176500109ABDB00CF95D988BDFB7BCEB44324F2042A9EA14A72D1D7355E458B94
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 004016B4 Relevance: 3.1, APIs: 2, Instructions: 130memorynativeCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 180 4016b4-4016c9 181 401859-401862 180->181 182 4016cf-4016d6 180->182 183 4016f5-401729 NtAllocateVirtualMemory 182->183 184 4016d8-4016f0 call 401000 182->184 183->181 186 40172f-40174c NtAllocateVirtualMemory 183->186 184->183 186->181 188 401752-40175a call 40152c 186->188 190 40175f-401761 188->190 190->181 191 401767-40176d 190->191 192 401774-401781 call 401000 191->192 193 40176f 191->193 196 401851-401854 192->196 197 401787-401798 call 401e78 192->197 193->181 196->191 200 4017c9-4017cc 197->200 201 40179a-4017c4 call 401e78 197->201 203 4017fa-4017fd 200->203 204 4017ce-4017f8 call 401e78 200->204 201->196 205 401815-401818 203->205 206 4017ff-401813 203->206 204->196 210 401830-401833 205->210 211 40181a-40182e 205->211 206->196 210->196 212 401835-40184b 210->212 211->196 212->196
                                                                                                                                                                APIs
                                                                                                                                                                • NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,?,00103000,00000040), ref: 0040171F
                                                                                                                                                                • NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000000,00103000,00000004), ref: 00401742
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2106664993.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2106606419.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2106992208.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2107146940.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2107215824.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_400000_D448.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AllocateMemoryVirtual
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2167126740-0
                                                                                                                                                                • Opcode ID: 4a0fb159cb167e270aa132b3f88ebad20637f68d71e3a3db65f788631af4fc76
                                                                                                                                                                • Instruction ID: ad4b5e7ce53ce887a57ee0cc443bca07838dd3003dcb7b2c4dfa2ad75add82e8
                                                                                                                                                                • Opcode Fuzzy Hash: 4a0fb159cb167e270aa132b3f88ebad20637f68d71e3a3db65f788631af4fc76
                                                                                                                                                                • Instruction Fuzzy Hash: E3416031904204DADF10EF58C884B9AB7A4FF05314F14C1BAE919EF2E6D7788A41CB6A
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 0040227C Relevance: 1.5, APIs: 1, Instructions: 29COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 288 40227c-4022ad FindFirstFileExW 289 4022d2-4022d8 288->289 290 4022af-4022cf 288->290 290->289
                                                                                                                                                                APIs
                                                                                                                                                                • FindFirstFileExW.KERNELBASE(?,00000000,?,00000000,00000000,00000000), ref: 004022A4
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2106664993.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2106606419.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2106992208.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2107146940.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2107215824.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_400000_D448.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FileFindFirst
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1974802433-0
                                                                                                                                                                • Opcode ID: cdec62c82a5867c9461e13d27f073131a42764883e1863d73d8ab6d37f0e38bf
                                                                                                                                                                • Instruction ID: 55f0629c3eadcc188d8749e42e063c0b49bca1bc4f8f265f590f61ae6da82bee
                                                                                                                                                                • Opcode Fuzzy Hash: cdec62c82a5867c9461e13d27f073131a42764883e1863d73d8ab6d37f0e38bf
                                                                                                                                                                • Instruction Fuzzy Hash: BBF0C974902608EFDB10DF94CD49B9DFBB4EB48310F2082A5A918AB2A0D7715E91CF84
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00401D94 Relevance: 1.5, APIs: 1, Instructions: 19nativethreadCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • NtSetInformationThread.NTDLL(00000000,?,00000000,00000000), ref: 00401DBB
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2106664993.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2106606419.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2106992208.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2107146940.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2107215824.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_400000_D448.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: InformationThread
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 4046476035-0
                                                                                                                                                                • Opcode ID: 2ec57d8305034ae4dcd04f6f280aec29aa5e37325b0f502564d07dd60a6e8475
                                                                                                                                                                • Instruction ID: 482b214da63c1bafeb7c1bb62a0bbbc62c262419b9af6fea3894fce228737229
                                                                                                                                                                • Opcode Fuzzy Hash: 2ec57d8305034ae4dcd04f6f280aec29aa5e37325b0f502564d07dd60a6e8475
                                                                                                                                                                • Instruction Fuzzy Hash: FEE05E329A020DAFD710DB50DC45FBB376DEB55311F508236B5029A1E0D6B8F891DA98
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00401B70 Relevance: 3.2, APIs: 2, Instructions: 156memoryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 100 401b70-401b9f RtlCreateHeap 101 401ba1 100->101 102 401ba6-401bc4 RtlCreateHeap 100->102 103 401d8a-401d90 101->103 104 401bc6 102->104 105 401bcb-401be7 102->105 104->103 107 401be9 105->107 108 401bee-401c05 call 401a40 105->108 107->103 111 401c07 108->111 112 401c0c-401c3d 108->112 111->103 115 401c44-401c5b call 401a40 112->115 116 401c3f 112->116 119 401c62-401c93 115->119 120 401c5d 115->120 116->103 123 401c95 119->123 124 401c9a-401cb1 call 401a40 119->124 120->103 123->103 127 401cb3 124->127 128 401cb8-401ce9 124->128 127->103 131 401cf0-401d07 call 401a40 128->131 132 401ceb 128->132 135 401d09 131->135 136 401d0b-401d3c 131->136 132->103 135->103 139 401d40-401d57 call 401a40 136->139 140 401d3e 136->140 143 401d59 139->143 144 401d5b-401d80 call 401d94 call 401dc2 139->144 140->103 143->103 147 401d83 144->147 147->103
                                                                                                                                                                APIs
                                                                                                                                                                • RtlCreateHeap.NTDLL(00001002,00000000,00000000,00000000,00000000,00000000), ref: 00401B96
                                                                                                                                                                • RtlCreateHeap.NTDLL(00041002,00000000,00000000,00000000,00000000,00000000), ref: 00401BBB
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2106664993.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2106606419.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2106992208.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2107146940.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2107215824.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_400000_D448.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateHeap
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 10892065-0
                                                                                                                                                                • Opcode ID: 453bda9d08a0096fe53e6a5bcc4a475ef93f8d776735eeddf63228c397926240
                                                                                                                                                                • Instruction ID: eac1ce902914894448f3c06d12ced00cbe17960004271ddceb971b2a38276b5e
                                                                                                                                                                • Opcode Fuzzy Hash: 453bda9d08a0096fe53e6a5bcc4a475ef93f8d776735eeddf63228c397926240
                                                                                                                                                                • Instruction Fuzzy Hash: 34513034A80A04FBD7109B60ED09B5B7770FF18701F2086BAE6117A2F1D775A5859F8D
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 004022DC Relevance: 3.1, APIs: 2, Instructions: 133COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 150 4022dc-40232e 154 402330 150->154 155 402335-402347 GetShortPathNameW 150->155 156 402483-402487 154->156 157 402349-402359 155->157 158 40235e-402380 155->158 159 402495-402499 156->159 160 402489-40248f 156->160 157->156 168 402382 158->168 169 402387-402425 158->169 163 4024a7-4024ab 159->163 164 40249b-4024a1 159->164 160->159 165 4024b9-4024bf 163->165 166 4024ad-4024b3 163->166 164->163 166->165 168->156 175 402427 169->175 176 402429-402481 ShellExecuteW 169->176 175->156 176->156
                                                                                                                                                                APIs
                                                                                                                                                                • GetShortPathNameW.KERNELBASE(00000000,00000000,?), ref: 00402340
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2106664993.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2106606419.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2106992208.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2107146940.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2107215824.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_400000_D448.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: NamePathShort
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1295925010-0
                                                                                                                                                                • Opcode ID: a0a4f684a9d9108a63d91a30c19249ae39ae68594d14297edb71c581cb82e24b
                                                                                                                                                                • Instruction ID: 5bcac900e59d09c9622bdf940851d370624af246baed8abb1bc217228d1f7e1b
                                                                                                                                                                • Opcode Fuzzy Hash: a0a4f684a9d9108a63d91a30c19249ae39ae68594d14297edb71c581cb82e24b
                                                                                                                                                                • Instruction Fuzzy Hash: B6514E75900606EFDB00DF90E948B9EFB71FF48301F2082A9E6156B2A1C375AA91DFC5
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 004026C0 Relevance: 3.1, APIs: 2, Instructions: 51fileCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 213 4026c0-4026e5 call 4024f8 215 402730-402734 213->215 216 4026e7-402709 CreateFileW 213->216 218 402742-402746 215->218 219 402736-40273c 215->219 216->215 217 40270b-402727 ReadFile 216->217 217->215 220 402729 217->220 221 402754-40275a 218->221 222 402748-40274e 218->222 219->218 220->215 222->221
                                                                                                                                                                APIs
                                                                                                                                                                • CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004026FF
                                                                                                                                                                • ReadFile.KERNELBASE(000000FF,000000FF,0000021C,?,00000000), ref: 00402722
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2106664993.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2106606419.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2106992208.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2107146940.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2107215824.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_400000_D448.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$CreateRead
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3388366904-0
                                                                                                                                                                • Opcode ID: 64d441af2ae5f8cd80c02da2bb5cacaba4a8c0a7bb8fd120945ed4e9a720f5dc
                                                                                                                                                                • Instruction ID: dec784d2d3492f4c007a4c80bb83cd8b4abde05e7af7cfb80cb91198c32a9eba
                                                                                                                                                                • Opcode Fuzzy Hash: 64d441af2ae5f8cd80c02da2bb5cacaba4a8c0a7bb8fd120945ed4e9a720f5dc
                                                                                                                                                                • Instruction Fuzzy Hash: 7511D774910209EFDB10DF94DD48B9FBBB5FB08311F2046A9A524B62E1D7B15A91CF84
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00401A40 Relevance: 1.6, APIs: 1, Instructions: 98memoryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 224 401a40-401a5a 225 401a5d-401a77 RtlAllocateHeap 224->225 226 401a85-401a94 call 401e78 225->226 227 401a79-401a82 225->227 230 401ac5-401ac8 226->230 231 401a96-401ac0 call 401e78 226->231 233 401af6-401af9 230->233 234 401aca-401af4 call 401e78 230->234 239 401b4d-401b55 231->239 237 401b11-401b14 233->237 238 401afb-401b0f 233->238 234->239 241 401b16-401b2a 237->241 242 401b2c-401b2f 237->242 238->239 239->225 243 401b5b-401b6b 239->243 241->239 242->239 244 401b31-401b47 242->244 244->239
                                                                                                                                                                APIs
                                                                                                                                                                • RtlAllocateHeap.NTDLL(00000000,00000008,00000010), ref: 00401A6D
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2106664993.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2106606419.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2106992208.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2107146940.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2107215824.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_400000_D448.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AllocateHeap
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1279760036-0
                                                                                                                                                                • Opcode ID: 3090814481001f51fad53404be7bb9f089635e5ecf5702693e45b6397da5dce2
                                                                                                                                                                • Instruction ID: 68c0462a3af62cc3e50a8e225ecc1fff045641083c52707b2e4de1a33f1d8fac
                                                                                                                                                                • Opcode Fuzzy Hash: 3090814481001f51fad53404be7bb9f089635e5ecf5702693e45b6397da5dce2
                                                                                                                                                                • Instruction Fuzzy Hash: 9F316935A14308DFDB10CF99C488E99F7F1BF24320F15D0AAD508AB2B2D7B59950DB4A
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00402E10 Relevance: 1.6, APIs: 1, Instructions: 66COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 245 402e10-402e35 247 402e37 245->247 248 402e39-402e4e 245->248 249 402eab-402eb7 247->249 253 402e50 248->253 254 402e52-402e57 248->254 250 402ec5-402eca 249->250 251 402eb9-402ebf 249->251 251->250 253->249 255 402e5c-402e6d 254->255 257 402e70-402e7a 255->257 257->257 258 402e7c-402e8f MoveFileExW 257->258 259 402e91 258->259 260 402e93-402ea9 258->260 259->249 260->249 260->255
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2106664993.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2106606419.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2106992208.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2107146940.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2107215824.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_400000_D448.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: 2ec2b1c2d5d64686e5e6a52de2e159d7ebe58570cf782c44f0051c3652f2bf9a
                                                                                                                                                                • Instruction ID: 64be472d3da9365df722bb42b6a14b0a0006b9682bbf08d732ce7ada7e71b141
                                                                                                                                                                • Opcode Fuzzy Hash: 2ec2b1c2d5d64686e5e6a52de2e159d7ebe58570cf782c44f0051c3652f2bf9a
                                                                                                                                                                • Instruction Fuzzy Hash: 8A214C71940208EFDB109F90DE49B9ABB71FF18301F2081BAE505AA2E1D3759E91DF89
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00402A78 Relevance: 1.6, APIs: 1, Instructions: 52COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 262 402a78-402a9c call 4028ba 264 402aa3-402ac2 262->264 265 402a9e 262->265 270 402ac4-402ad3 264->270 271 402ad5-402ae0 264->271 266 402b28-402b2c 265->266 267 402b3a-402b40 266->267 268 402b2e-402b34 266->268 268->267 270->266 274 402ae2-402ae8 271->274 275 402aea 271->275 276 402af0-402b1f CreateMutexW 274->276 275->276 276->266 277 402b21 276->277 277->266
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2106664993.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2106606419.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2106992208.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2107146940.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2107215824.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_400000_D448.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: 76ac4189c2e983f292498be2e35779ead737e5081f8c929ef40d6d428a78efce
                                                                                                                                                                • Instruction ID: 5f31ce468cef0475a522e9655e813cee8f96e501922e94d34a843d9ecc1c4f5f
                                                                                                                                                                • Opcode Fuzzy Hash: 76ac4189c2e983f292498be2e35779ead737e5081f8c929ef40d6d428a78efce
                                                                                                                                                                • Instruction Fuzzy Hash: A921F974901608EFDB00CF90EA8C79EBB71FF08301F6045A9E5017A2A0D7B95A85DF89
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00401474 Relevance: 1.5, APIs: 1, Instructions: 38libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 279 401474-401488 280 40148a-40148d 279->280 281 4014ac-4014b3 call 4013f8 279->281 282 401493-401498 280->282 285 4014b8-4014d2 LdrLoadDll 281->285 282->282 284 40149a-4014aa call 4013f8 282->284 284->285
                                                                                                                                                                APIs
                                                                                                                                                                • LdrLoadDll.NTDLL(00000000,00000000,00000000,?), ref: 004014C4
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2106664993.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2106606419.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2106992208.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2107146940.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2107215824.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_400000_D448.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Load
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2234796835-0
                                                                                                                                                                • Opcode ID: cc821bb6490c49b643c0aee4c8a66cc2fb92e167f5171f05bab2522af16bb81c
                                                                                                                                                                • Instruction ID: 140de97a3c31e0856ca0b204e221eb1e366fb0b1d4fd9a07ba92ba20ce5f8dd4
                                                                                                                                                                • Opcode Fuzzy Hash: cc821bb6490c49b643c0aee4c8a66cc2fb92e167f5171f05bab2522af16bb81c
                                                                                                                                                                • Instruction Fuzzy Hash: F7F03C3690020DFADF10EAA4D848FDE77BCEB14314F0041A6E904B7190D238AA099BA5
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00402836 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RtlAdjustPrivilege.NTDLL(?,00000001,00000000,00000000), ref: 00402861
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2106664993.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2106606419.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2106992208.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2107146940.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2107215824.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_400000_D448.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AdjustPrivilege
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3260937286-0
                                                                                                                                                                • Opcode ID: b838e4be5c385c0dc624d50355c604d381d153ee0a89857c9e86ae645bc67477
                                                                                                                                                                • Instruction ID: 70193a9dbc7aa9cd3770003b3bb97339f6e2972f30e24310785a39762e1cef45
                                                                                                                                                                • Opcode Fuzzy Hash: b838e4be5c385c0dc624d50355c604d381d153ee0a89857c9e86ae645bc67477
                                                                                                                                                                • Instruction Fuzzy Hash: B9E0263251821AABCB20A2189E0CBA7739DD744314F1043B6A805F71D1EAF69A0A87DA
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 004020BC Relevance: 1.5, APIs: 1, Instructions: 12memoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RtlAllocateHeap.NTDLL(?,00000008,?), ref: 004020D7
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000009.00000002.2106664993.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000009.00000002.2106606419.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2106992208.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2107146940.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                • Associated: 00000009.00000002.2107215824.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_9_2_400000_D448.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AllocateHeap
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1279760036-0
                                                                                                                                                                • Opcode ID: 37c2d1e8b064bb17fe79b9677c4ca25dfdae977e826a45f6764b5f2e7935cd48
                                                                                                                                                                • Instruction ID: 701e22a529f931561d5ec47da2ef603e250127bb9ab3ab4db12cbc5835053477
                                                                                                                                                                • Opcode Fuzzy Hash: 37c2d1e8b064bb17fe79b9677c4ca25dfdae977e826a45f6764b5f2e7935cd48
                                                                                                                                                                • Instruction Fuzzy Hash: 05D0C97A140609ABC6009F94E949D87F769FF58711B00C6A1BA045B222C630E890CFD4
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%